Apple macOS - stackshot Raw Frame Pointers Exploit

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1164
 
This is an issue that allows unentitled root to read kernel frame
pointers, which might be useful in combination with a kernel memory
corruption bug.
 
By design, the syscall stack_snapshot_with_config() permits unentitled
root to dump information about all user stacks and kernel stacks.
While a target thread, along with the rest of the system, is frozen,
machine_trace_thread64() dumps its kernel stack.
machine_trace_thread64() walks up the kernel stack using the chain of
saved RBPs. It dumps the unslid kernel text pointers together with
unobfuscated frame pointers.
 
The attached PoC dumps a stackshot into the file stackshot_data.bin
when executed as root. The stackshot contains data like this:
 
00000a70  de 14 40 00 80 ff ff ff  a0 be 08 77 80 ff ff ff  |[email protected]|
00000a80  7b b8 30 00 80 ff ff ff  20 bf 08 77 80 ff ff ff  |{.0..... ..w....|
00000a90  9e a6 30 00 80 ff ff ff  60 bf 08 77 80 ff ff ff  |..0.....`..w....|
00000aa0  5d ac 33 00 80 ff ff ff  b0 bf 08 77 80 ff ff ff  |].3........w....|
 
The addresses on the left are unslid kernel text pointers; the
addresses on the right are valid kernel stack pointers.
 
 
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/42047.zip

#  0day.today [2018-04-03]  #