![](http://1.bp.blogspot.com/-BEbEha_KlFc/VBpvbUQGl-I/AAAAAAAAALk/dW5wH-axcq0/s1600/apple-safari-icon.jpg) Apple CoreGraphics framework fails to validate the input when parsing **CCITT group 3** encoded data resulting in a heap overflow condition. A small heap memory allocation can be overflowed with controlled data from the input resulting in arbitrary code execution in the context of Mobile Safari. Using a crafted PDF file as an HTML image and combined with a [ information leakage vulnerability]() this issue leads to arbitrary code execution. A complete 100% reliable and portable proof of concept exploit for MobileSafari on IOS7.1.x. can be downloaded from [github]() Quick links: [White paper](), [PoC Exploit generator in python]() # Summary * Title: Apple CoreGraphics Memory Corruption * CVE Name: CVE-2014-4481 * Permalink: http://blog.binamuse.com/2015/01/coregraphics-ccitt-memory-corruption.html * Date published: 2015-01-27 * Date of last update: 2015-01-27 * Class: Client side / Integer Overflow / Memory Corruption * Advisory: [HT204245]() # Vulnerability Details Safari accepts PDF files as native image format for the < image > html tag. Thus browsing an html page in Safari can transparently load multiple pdf files without any further user interaction. CoreGraphics is the responsible of parsing the PDF files. Apple Core Graphics framework fails to validate the input when parsing CCITT group 3 encoded data. A small heap memory allocation can be overflowed with controled data from the input enabling arbitrary code execution in the context of Mobile Safari. The Core Graphics framework is a C-based API that is based on the [Quartz]() advanced drawing engine. It provides low-level, lightweight 2D rendering. This is used in a wide range of applications to handle path-based drawing, transformations, color management, offscreen rendering, patterns, gradients and shadings, image data management, image creation, masking, and PDF document creation, display, and parsing. CoreGraphics library implements the functionality to load and save several graphic formats such as PDFs and it is used by most common applications that deal with images, including Safari, Preview, Skype, etc. The 32 bit version of the framework also implements the _x_malloc_ heap, a set of low level procedures to manage an internal heap memory structure used when processing images of different types (including PDF files). The functions _x_malloc_ and _x_free_ are used very frequently to allocate and de-allocate memory fast. The _x_malloc_ function behaves as a normal [malloc]() except it allocates a bit extra memory for metadata. It actually allocates an extra _2*sizeof(void*)_ bytes and pad the resulting size to the next 16 byte border. When the chunk is in use (allocated) this extra space is used to hold the size of the chunk, thus making it super fast to free. On the other hand when the chunk is free the metadata space is used to form a free-list linked list, the first metadata value in a free chunk points to the next free chunk. This is its pseudocode. Think _x_mem_alloc0_size_ as a plain malloc. void * __cdecl x_malloc ( size_t size ) { void * buffer = x_mem_alloc0_s ize (( size + 31) & -16) ; *( size_t *) buffer = ( size + 31) & -16; return buffer + 16; } This function is prone to integer overflow because it doesn’t check for _size_ to be less than _MAXUINT-16_. Then if a programmer tries to allocate a size in the range [-16,-1] _x_malloc_ will allocate 0(zero) or 16 bytes (instead of the immense value required) without triggering any exception. ## CCITTFaxDecode group 3 x_malloc bug A _x_malloc_ bug is triggered when decoding **CCITT group 3** compressed data. The _CCITTFaxDecode_ pdf filter decodes image data that has been encoded using either _Group 3_ or _Group 4 CCITT_ facsimile (fax) encoding. _CCITT_ encoding is designed to achieve efficient compression of monochrome (1 bit per pixel) image data at relatively low resolutions, and so is useful only for bitmap image data, not for color images, grayscale images, or general data. Any PDF Stream can be compressed using a different set of filters as described in [PDFSPEC::7.3.8::Streams](). Under certain conditions the implelentation of the _CCITTFaxDecode_ filter fails to allocate the correct amount of memory for its internal state. It allocates an overly small array that can be overflowded with controlled data. The decoding parmeters of any pdf filter are controled via the /decodeparams field of the stream dictionary. The _CCITTFaxDecode_ filter parses its decoding parameters at the function _pdf_source_create_ccitt_fax_filter_ (see appendix for pseudocode). After the decode parameters are parsed an validated the CCITTFaxDecode internal state is allocated at functions _pdf_FaxDecodeStateAlloc_. Setting a _/Columns_ value of _0x3fffffff-4_ enables the attacker to reach _x_malloc_with a size in the [16,-1] range (without trigering any exceptions). Thus, the _pdf_FaxDecodeStateAlloc_ function will reseve a small amount of memory for holding a potentially big array of encoded _CCITT group3_ 1D runlenghts values (See [rfc804]()). PDF CCITTFaxDecode filter can handle a number of _CCITT_ encodings, _K=0_ selects the vulnerable code (namely CCITT group 3 or G31D). An example of the _/DecodeParams_dictionary nedded to reach the vulnerable code follows: /DecodeParms << /Rows 0 /EndOfBlock true /K 0 /BlackIs1 true /EncodedByteAlign false /Columns 1073741819 /EndOfLine false >> The _pdf_FaxDecodeStateAlloc_ function silently fails to reserve enough space to decode a line of potentially 0x3fffffff-4 runlengths codes. The actual decoding is done at the function pdf_FaxDecode. This function decodes the input stream of _CCITT G31D_ encoded runlength. _CCITT group 3_ works in a line by line pace, at each line it will iterativelly consume white an black runlengths. Each decoded runlength is appended to the internaly allocated array of 16 bit words. The decompression algorithm is best described in [3]. As the attaker controls the raw input it may craft a list of _CCITT_ runlength codes to overwrite the overly short _16bit_ word array with a controlled amount of controlled data. Function lookup table based on firmware _iPhone5,1-7.1.2_, follows: 0x2D57C824 pdf_FaxDecodeStateAlloc 0x2D57EF64 pdf_source_create_ccitt_fax_filter 0x2D57C8D8 pdf_FaxDecode Assume _dyld_shared_cache_ base address is 0x2c00000. # Exploitation A 100% reliable PoC exploit can be downloaded from the [github project](). This exploit needs a companion information leakage vulnerability to bypass ASLR, DEP and Code signing iOS exploit mitigations. The exploit is presented as a cgi script that expects to get the dyld_shared_cache address, the shellcode address and the iOS version as GET parameters. It executes arbitrary code in the context of SafariMobile. # Listings int __cdecl pdf_source_create_ccitt_fax_filter(void *arg0, int a1) { ccitt *ccitt; int result; int K; bool flags_a; signed int ccitt_group_; int flags_b; int flags_c; int flags; char blackIsZERO; FaxDecodeState *state; int ccitt_group; char value_bool; int value_int; ccitt = x_calloc(1, 32); result = 0; if ( ccitt ) { ccitt->K = 0; ccitt->EOL = 0; ccitt->EncodedByteAlign = 0; ccitt->Columns = 1728; ccitt->Rows = 0; ccitt->EndOfBlock = 1; ccitt->BlackIs1 = 0; ccitt->DamagedRowsBeforeError = 0; if ( a1 ) { if ( CGPDFDictionaryGetInteger(a1, "K", &value_int) ) ccitt->K = value_int; if ( CGPDFDictionaryGetBoolean(a1, "EndOfLine", &value_bool) ) ccitt->EOL = value_bool != 0; if ( CGPDFDictionaryGetBoolean(a1, "EncodedByteAlign", &value_bool) ) ccitt->EncodedByteAlign = value_bool != 0; if ( CGPDFDictionaryGetInteger(a1, "Columns", &value_int) ) { if ( value_int < 0 ) pdf_error("/%s is outside the range of allowed values.", "Columns"); else ccitt->Columns = value_int; } v2 = 3793108; if ( CGPDFDictionaryGetInteger(a1, "Rows", &value_int) ) { if ( value_int < 0 ) pdf_error("/%s is outside the range of allowed values.", "Rows"); else ccitt->Rows = value_int; } if ( CGPDFDictionaryGetBoolean(a1, "EndOfBlock", &value_bool) ) ccitt->EndOfBlock = value_bool != 0; if ( CGPDFDictionaryGetBoolean(a1, "BlackIs1", &value_bool) ) ccitt->BlackIs1 = value_bool != 0; if ( CGPDFDictionaryGetInteger(a1, "DamagedRowsBeforeError", &value_int) ) { if ( value_int < 0 ) pdf_error("/%s is outside the range of allowed values.", "DamagedRowsBeforeError"); else ccitt->DamagedRowsBeforeError = value_int; } } K = ccitt->K; if ( K < 0 ) { ccitt_group_ = 4; flags_a = 0; } else { flags_a = K > 0; ccitt_group_ = 3; } ccitt_group = ccitt_group_; flags_b = flags_a + 2; if ( !ccitt->EOL ) flags_b = flags_a; flags_c = flags_b | 4; if ( !ccitt->EncodedByteAlign ) flags_c = flags_b; if ( ccitt->EndOfBlock ) { ccitt->Rows = 0; flags_c |= 8u; } flags = flags_c | 0x10; blackIsZERO = ccitt->BlackIs1 == 0; LOBYTE(ccitt->flags) = 0; if ( !blackIsZERO ) flags = flags_c; ccitt->source = CGPDFSourceRetain(arg0); state = pdf_FaxDecodeStateAlloc(ccitt->Columns, ccitt_group, flags); ccitt->fax_decode_state = state; if ( !state || (state->getc = (ccitt_fax_filter_getc), ccitt->fax_decode_state->stream = arg0, (result = CGPDFSourceCreateFilter( ccitt, (ccitt->Columns + (((ccitt->Columns + 7) >> 31) >> 29) + 7) >> 3, &pdf_source_create_ccitt_fax_filter_callbacks)) == 0) ) { ccitt_fax_filter_finalize(ccitt); result = 0; } } return result; } FaxDecodeState *__cdecl pdf_FaxDecodeStateAlloc(int columns, int group, int flags) { FaxDecodeState *retval; int size; FaxDecodeState *state; int N; _WORD *buf; unsigned int last; int ptr; char is4; retval = 0; size = columns; if ( columns <= 0x3FFFFFFF ) { state = x_calloc(1, 0x38); if ( state ) { state->group = group; state->flags = flags; state->columns = columns; state->columns_rnd = (columns + (((columns + 7) >> 31) >> 29) + 7) >> 3; is4 = (group == 4) | flags & 1; if ( is4 ) size = (2 * columns + 62) & 0xFFFFFFC0; N = 2 * size + 3; if ( N >= 0 ) { buf = x_malloc(2 * N); state->line_buffer = buf; if ( buf ) { state->line_buffer2 = buf; last = size >> 1; if ( is4 & 1 ) size = size >> 1; state->N = size; if ( is4 & 1 ) { ptr = &buf[last]; state->tail = ptr; } else { state->tail = 0; ptr = 0; } state->code_bitcount = 0; state->bitaccu = 0; state->field_18 = 0; retval = state; if ( ptr ) { *ptr = LOWORD(state->columns); *(ptr + 2) = 0; retval = state; } } } } } return retval; } # C Structures The structures used. 00000000 ccitt struc ; (sizeof=0x20) 00000000 source dd ? 00000004 flags dd ? 00000008 K dd ? 0000000C Rows dd ? 00000010 Columns dd ? 00000014 EOL db ? 00000015 EncodedByteAlign db ? 00000016 EndOfBlock db ? 00000017 BlackIs1 db ? 00000018 DamagedRowsBeforeError dd ? 0000001C fax_decode_state dd ? ; offset 00000020 ccitt ends 00000020 00000000 ; --------------------------------------------------------------------- 00000000 00000000 FaxDecodeState struc ; (sizeof=0x38) 00000000 group dd ? 00000004 flags dd ? ; 0x10 BlackIsZero0 00000004 ; 0x08 EndOfBlock 00000004 ; 0x04 EncodedByteAlign 00000004 ; 0x02 EOL 00000004 ; 0x01 K>0 00000008 columns_rnd dd ? 0000000C columns dd ? 00000010 bitaccu dd ? 00000014 code_bitcount dd ? 00000018 field_18 dd ? 0000001C line_buffer dd ? ; offset 00000020 tail dd ? ; offset 00000024 line_buffer2 dd ? ; offset 00000028 N dd ? 0000002C field_2C dd ? 00000030 getc dd ? ; offset 00000034 stream dd ? ; offset 00000038 FaxDecodeState ends 00000038 # Demo Soon.. maybe.

Query Builder