Apple macOS - 'stackshot' Raw Frame Pointers(CVE-2017-2516)

ID SSV:93161
Type seebug
Reporter Root
Modified 2017-05-27T00:00:00


This is an issue that allows unentitled root to read kernel frame pointers, which might be useful in combination with a kernel memory corruption bug.

By design, the syscall stack_snapshot_with_config() permits unentitled root to dump information about all user stacks and kernel stacks. While a target thread, along with the rest of the system, is frozen, machine_trace_thread64() dumps its kernel stack. machine_trace_thread64() walks up the kernel stack using the chain of saved RBPs. It dumps the unslid kernel text pointers together with unobfuscated frame pointers.

The attached PoC dumps a stackshot into the file stackshot_data.bin when executed as root. The stackshot contains data like this: 00000a70 de 14 40 00 80 ff ff ff a0 be 08 77 80 ff ff ff |..@........w....| 00000a80 7b b8 30 00 80 ff ff ff 20 bf 08 77 80 ff ff ff |{.0..... ..w....| 00000a90 9e a6 30 00 80 ff ff ff 60 bf 08 77 80 ff ff ff |..0.....`..w....| 00000aa0 5d ac 33 00 80 ff ff ff b0 bf 08 77 80 ff ff ff |].3........w....| The addresses on the left are unslid kernel text pointers; the addresses on the right are valid kernel stack pointers.

Proof of Concept: