Mbuf oflow - Finding vulnerabilities in iOS/macOS networking code - kevin backhouse (semmle)

•

0 likes•86 views

Semmle security researcher Kevin Backhouse explains how network packets are structured, and how the mbuf datatype is used to process them in XNU. Learn how corner cases that were handled incorrectly in XNU, making the code vulnerable to remote attack.

Technology

Kevin Backhouse
Semmle Security Research Team

1. packet mangler
CVE-2017-13904, CVE-2018-4249, CVE-2018-4460
2. NFS client
CVE-2018-4259, CVE-2018-4286, CVE-2018-4287, CVE-2018-4288,
CVE-2018-4291
3. icmp_error
CVE-2018-4407

1. TCP/IP packet structure
2. Raw socket programming in C (on Linux)
3. XNU’s mbuf datatype
4. Using RPC to implement a fake NFS server
5. QL query writing

CVE-2017-13904 (inﬁnite loop)
CVE-2018-4249 (stack buffer overﬂow)
CVE-2018-4460 (inﬁnite loop)

Demo:
─ Search for unsafe array indices using
─ Find CVE-2017-13904

ip
options
tcp
options
payload
20
bytes
0 - 40
bytes
20
bytes
0 - 40
bytes
0-64k
bytes

─ Sample code:
─ www.binarytides.com/raw-sockets-c-code-linux/
─ github.com/Semmle/SecurityExploits

Timeline:
─ 2017-07-14 Reported bug (CVE-2017-13904) to Apple
─ 2018-02-09 Asked Apple: “When is it going to be ﬁxed?”
─ 2018-02-13 Apple: “We ﬁxed it in December.”
So I had another look ...

─ No source code until Oct 2018
─ Turns out they forgot to ﬁx one of the inﬁnite loop bugs

CVE-2018-4259
CVE-2018-4286
CVE-2018-4287
CVE-2018-4288
CVE-2018-4291

─ Now I know what to look for:
─
─
─ (aka )
─
─
─ Use dataﬂow/taint analysis to search for ﬂow from
to , to , etc.

─ Use rpcgen to create an RPC server application.
─ Simplest bug happens at mount time, so only need to
implement a handful of operations:
─ NFSPROC3_NULL
─ MOUNTPROC3_NULL
─ MOUNTPROC3_MNT (returns malicious ﬁle handle)
─ Source code is on GitHub.
─ Just 46 lines of C and 63 lines of RPC language!

─ Sends an error message when something goes wrong,
using the ICMP protocol
─ For example: calls when the
ip options are invalid
─ How the exploit works:
─ Send a TCP packet with invalid ip options
─ Make the TCP/IP headers as big as possible (120 bytes)

─ I have taken a break from XNU and am looking at other
open source projects
─ Goal for 2019: learn exploitation techniques
─ Is XNU’s networking code bug-free now?
─ I doubt it
─ alone is 3428 lines long
─ Not algorithmically complex, just lots and lots of cases

What's hot

Ch 5: Port ScanningSam Bowne

Taking Security Groups to Ludicrous Speed with OVS (OpenStack Summit 2015)Thomas Graf

BPF: Next Generation of Programmable DatapathThomas Graf

TC Flower OffloadNetronome

Distributed app development with nodejs and zeromqRuben Tan

Port Scanningamiable_indian

Nb iot-nfapi-implementation-1Yafie Abdillah

Building your own CGN boxes with LinuxMaximilan Wilhelm

Scapy talkAshwin Patil, GCIH, GCIA, GCFE

OSDC 2017 - Casey Callendrello -The evolution of the Container Network InterfaceNETWAYS

Open vSwitch - Stateful Connection Tracking & Stateful NATThomas Graf

Netcatpenetration Tester

[9-6-2016] Openlab Poster-v3Ioannis Charalampidis

memcached Binary Protocol in a NutshellToru Maesaka

Scapy TLS: A scriptable TLS 1.3 stackAlexandre Moneger

Netcat - A Swiss Army ToolChandrapal Badshah

Assignment 1-mtatzafargilani

Nsq meetup-messagingGuillaume Arnaud

DevoxxFR 2016 - 3 degrees of MoMGuillaume Arnaud

What's hot (19)

Ch 5: Port Scanning

Taking Security Groups to Ludicrous Speed with OVS (OpenStack Summit 2015)

BPF: Next Generation of Programmable Datapath

TC Flower Offload

Distributed app development with nodejs and zeromq

Port Scanning

Nb iot-nfapi-implementation-1

Building your own CGN boxes with Linux

Scapy talk

OSDC 2017 - Casey Callendrello -The evolution of the Container Network Interface

Open vSwitch - Stateful Connection Tracking & Stateful NAT

Netcat

[9-6-2016] Openlab Poster-v3

memcached Binary Protocol in a Nutshell

Scapy TLS: A scriptable TLS 1.3 stack

Netcat - A Swiss Army Tool

Assignment 1-mtat

Nsq meetup-messaging

DevoxxFR 2016 - 3 degrees of MoM

Similar to Mbuf oflow - Finding vulnerabilities in iOS/macOS networking code - kevin backhouse (semmle)

Making our networking stack truly extensible Olivier Bonaventure

Hackerworkshop exercisesHenrik Kramshøj

A Kernel of Truth: Intrusion Detection and Attestation with eBPFoholiab

DevSecCon London 2019: A Kernel of Truth: Intrusion Detection and Attestation...DevSecCon

D. Fast, Simple User-Space Network Functions with Snabb (RIPE 77)Igalia

Introduction to TCP/IPFrank Fang Kuo Yu

OSDC 2017 | The evolution of the Container Network Interface by Casey Callend...NETWAYS

Hunting for APT in network logs workshop presentationOlehLevytskyi1

Scaling the Container Dataplane Michelle Holley

ACN solved Manual By Ketan.pdfrushikeshspanchal75

BPF & Cilium - Turning Linux into a Microservices-aware Operating SystemThomas Graf

Install FD.IO VPP On Intel(r) Architecture & Test with Trex*Michelle Holley

Rina p4 rina workshopEduard Grasa

Group Apresramya5a

C Cpresramya5a

Kernel Recipes 2014 - NDIV: a low overhead network traffic diverterAnne Nicolas

Kernel bug huntingAndrea Righi

mTCP使ってみたHajime Tazaki

Similar to Mbuf oflow - Finding vulnerabilities in iOS/macOS networking code - kevin backhouse (semmle) (20)

Making our networking stack truly extensible

Hackerworkshop exercises

A Kernel of Truth: Intrusion Detection and Attestation with eBPF

DevSecCon London 2019: A Kernel of Truth: Intrusion Detection and Attestation...

D. Fast, Simple User-Space Network Functions with Snabb (RIPE 77)

Introduction to TCP/IP

OSDC 2017 | The evolution of the Container Network Interface by Casey Callend...

Hunting for APT in network logs workshop presentation

Scaling the Container Dataplane

ACN solved Manual By Ketan.pdf

BPF & Cilium - Turning Linux into a Microservices-aware Operating System

Install FD.IO VPP On Intel(r) Architecture & Test with Trex*

Rina p4 rina workshop

Group Apres

C Cpres

Kernel Recipes 2014 - NDIV: a low overhead network traffic diverter

Kernel bug hunting

mTCP使ってみた

Recently uploaded

Unblocking The Main Thread Solving ANRs and Frozen FramesSinan KOZAK

SIEMENS: RAPUNZEL – A Tale About Knowledge GraphNeo4j

Breaking the Kubernetes Kill Chain: Host Path MountPuma Security, LLC

08448380779 Call Girls In Friends Colony Women Seeking MenDelhi Call girls

The transition to renewables in India.pdfCompetition Advisory Services (India) LLP

Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...HostedbyConfluent

08448380779 Call Girls In Diplomatic Enclave Women Seeking MenDelhi Call girls

Presentation on how to chat with PDF using ChatGPT code interpreternaman860154

GenCyber Cyber Security Day PresentationMichael W. Hawkins

08448380779 Call Girls In Greater Kailash - I Women Seeking MenDelhi Call girls

Benefits Of Flutter Compared To Other FrameworksSoftradix Technologies

CloudStudio User manual (basic edition):comworks

Artificial intelligence in the post-deep learning eraDeakin University

Hyderabad Call Girls Khairatabad ✨ 7001305949 ✨ Cheap Price Your BudgetEnjoy Anytime

WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure servicePooja Nehwal

Swan(sea) Song – personal research during my six years at Swansea ... and bey...Alan Dix

Human Factors of XR: Using Human Factors to Design XR SystemsMark Billinghurst

Next-generation AAM aircraft unveiled by Supernal, S-A2Hyundai Motor Group

Slack Application Development 101 Slidespraypatel2

The Codex of Business Writing Software for Real-World Solutions 2.pptxMalak Abu Hammad

Recently uploaded (20)

Unblocking The Main Thread Solving ANRs and Frozen Frames

SIEMENS: RAPUNZEL – A Tale About Knowledge Graph

Breaking the Kubernetes Kill Chain: Host Path Mount

08448380779 Call Girls In Friends Colony Women Seeking Men

The transition to renewables in India.pdf

Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...

08448380779 Call Girls In Diplomatic Enclave Women Seeking Men

Presentation on how to chat with PDF using ChatGPT code interpreter

GenCyber Cyber Security Day Presentation

08448380779 Call Girls In Greater Kailash - I Women Seeking Men

Benefits Of Flutter Compared To Other Frameworks

CloudStudio User manual (basic edition):

Artificial intelligence in the post-deep learning era

Hyderabad Call Girls Khairatabad ✨ 7001305949 ✨ Cheap Price Your Budget

WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service

Swan(sea) Song – personal research during my six years at Swansea ... and bey...

Human Factors of XR: Using Human Factors to Design XR Systems

Next-generation AAM aircraft unveiled by Supernal, S-A2

Slack Application Development 101 Slides

The Codex of Business Writing Software for Real-World Solutions 2.pptx

Mbuf oflow - Finding vulnerabilities in iOS/macOS networking code - kevin backhouse (semmle)

1. Kevin Backhouse Semmle Security Research Team

2. 1. packet mangler CVE-2017-13904, CVE-2018-4249, CVE-2018-4460 2. NFS client CVE-2018-4259, CVE-2018-4286, CVE-2018-4287, CVE-2018-4288, CVE-2018-4291 3. icmp_error CVE-2018-4407

3. 1. TCP/IP packet structure 2. Raw socket programming in C (on Linux) 3. XNU’s mbuf datatype 4. Using RPC to implement a fake NFS server 5. QL query writing

4. CVE-2017-13904 (infinite loop) CVE-2018-4249 (stack buffer overflow) CVE-2018-4460 (infinite loop)

6. Demo: ─ Search for unsafe array indices using ─ Find CVE-2017-13904

8. ip options tcp options payload 20 bytes 0 - 40 bytes 20 bytes 0 - 40 bytes 0-64k bytes

9. ─ Sample code: ─ www.binarytides.com/raw-sockets-c-code-linux/ ─ github.com/Semmle/SecurityExploits

10.

11.

12. Timeline: ─ 2017-07-14 Reported bug (CVE-2017-13904) to Apple ─ 2018-02-09 Asked Apple: “When is it going to be ﬁxed?” ─ 2018-02-13 Apple: “We ﬁxed it in December.” So I had another look ...

13.

14.

15.

16.

17. ─ No source code until Oct 2018 ─ Turns out they forgot to ﬁx one of the inﬁnite loop bugs

18. CVE-2018-4259 CVE-2018-4286 CVE-2018-4287 CVE-2018-4288 CVE-2018-4291

19.

20. ─ Now I know what to look for: ─ ─ ─ (aka ) ─ ─ ─ Use dataﬂow/taint analysis to search for ﬂow from to , to , etc.

21.

22.

23.

24. ─ Use rpcgen to create an RPC server application. ─ Simplest bug happens at mount time, so only need to implement a handful of operations: ─ NFSPROC3_NULL ─ MOUNTPROC3_NULL ─ MOUNTPROC3_MNT (returns malicious ﬁle handle) ─ Source code is on GitHub. ─ Just 46 lines of C and 63 lines of RPC language!

25.

26.

27. CVE-2018-4407

28.

29. ─ Source: ─ Sink:

30. ─ Sends an error message when something goes wrong, using the ICMP protocol ─ For example: calls when the ip options are invalid ─ How the exploit works: ─ Send a TCP packet with invalid ip options ─ Make the TCP/IP headers as big as possible (120 bytes)

31. ─ I have taken a break from XNU and am looking at other open source projects ─ Goal for 2019: learn exploitation techniques ─ Is XNU’s networking code bug-free now? ─ I doubt it ─ alone is 3428 lines long ─ Not algorithmically complex, just lots and lots of cases

32. Semmle

Mbuf oflow - Finding vulnerabilities in iOS/macOS networking code - kevin backhouse (semmle)

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Similar to Mbuf oflow - Finding vulnerabilities in iOS/macOS networking code - kevin backhouse (semmle)

Similar to Mbuf oflow - Finding vulnerabilities in iOS/macOS networking code - kevin backhouse (semmle) (20)

Recently uploaded

Recently uploaded (20)

Mbuf oflow - Finding vulnerabilities in iOS/macOS networking code - kevin backhouse (semmle)