MacOS/iOS kernel heap overflow in bpf (CVE-2017-2482)

The bpf ioctl BIOCSBLEN allows userspace to set the bpf buffer length:

`` case BIOCSBLEN: /_ u_int _/ if (d->bd_bif != 0) error = EINVAL; else { u_int size;

 bcopy(addr, &size, sizeof (size));

 if (size > bpf_maxbufsize)
 size = bpf_maxbufsize;
 else if (size < BPF_MINBUFSIZE)
 size = BPF_MINBUFSIZE;
 bcopy(&size, addr, sizeof (size));
 d->bd_bufsize = size;
}
break;

``

d->bd_bif is set to the currently attached interface, so we can’t change the length if we’re already attached to an interface.

There’s no ioctl command to detach us from an interface, but we can just destroy the interface (by for example attaching to a bridge interface.) We can then call BIOCSBLEN again with a larger length which will set d->bd_bufsize to a new, larger value.

If we then attach to an interface again we hit this code in bpf_setif:

if (d->bd_sbuf == 0) { error = bpf_allocbufs(d); if (error != 0) return (error);

This means that the buffers actually won’t be reallocated since d->bd_sbuf will still point to the old buffer. This means that d->bd_bufsize is out of sync with the actual allocated buffer size leading to heap corruption when packets are receive on the target interface.

This PoC sets a small buffer length then creates and attaches to a bridge interface. It then destroys the bridge interface (which causes bpfdetach to be called on that interface, clearing d->bd_bif for our the bpf device.)

We then set a large buffer size and attach to the loopback interface and sent some large ping packets.

This bug is a root -> kernel priv esc

tested on MacOS 10.12.3 (16D32) on MacbookAir5,2

Annex: the bpf. c