Apple iOS / macOS - NSKeyedArchiver Memory Corruption Due to Lack of Bounds Checking in CAMediaTimin

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1175
 
CAMediaTimingFunctionBuiltin is a class in QuartzCore. Its initWithCoder: method
reads an Int "index" then passes that to builtin_function
 
  mov     ebx, edi <-- controlled unsigned int
  mov     r14d, ebx
  lea     r15, __ZL9functions_0 ; functions
  mov     rax, [r15+r14*8]
 
if rax is non-null it's returned as an objective-c object pointer and the objective-c retain
selector is sent to it.
 
Serialized poc in attached file with an index of 12345678.
 
tested on MacOS 10.12.3 (16D32)
 
 
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/42052.zip


#  0day.today [2018-01-05]  #