Feeds

Embedded problems: exploiting NULL pointer dereferences

Your device could be at risk

Protecting against web application threats using SSL

Interview Barnaby Jack developed a method for exploiting certain NULL pointer dereferences on the ARM and XScale architectures (and likely PowerPC). This method affects a lot of devices since most mobile phones and PDA are ARM based, and high-end routers often use the XScale architecture.

Could you introduce yourself?

Barnaby Jack: I'm a staff security researcher at Juniper Networks. I've been involved in computer security for a number of years, mostly dealing with operating system internals, reverse engineering, and anything low-level. I've recently started to focus some of my research efforts into embedded systems - I'm having fun with it. I'm a kiwi born and bred, but these days I'm living way across the pond up in the bay area.

Could you describe the vector rewrite attack you have developed?

Barnaby Jack: The Vector Rewrite Attack is a method for exploiting certain NULL pointer dereferences on the ARM and XScale architectures. In general, NULL pointer dereference flaws are considered non-exploitable. On the XScale and ARM architectures the memory address 0 is mapped, and also holds the exception vector table. The exception vector table is a set of branch instructions that correspond to different exceptions, such as software and hardware interrupts. When a case arises that writes to the 0 address with user-defined source data, it is possible to gain execution control by rewriting the exception table.

On many embedded devices, execution is running in Supervisor (SVC) mode so memory access is unrestricted. The PowerPC architecture also stores the vector table at a low address, and is likely vulnerable to this same attack. Research into the PPC architecture is ongoing.

A short paper describing the attack is available here (pdf).

There were some comments around the net about your attack and its link with the JTAG interface. Could you please explain us how you used JTAG and the link with your attack?

Barnaby Jack: The JTAG interface is a hardware interface that when used in conjunction with a hardware debugging probe, allows live debugging of the embedded processor. JTAG is simply used as a debugging mechanism. JTAG is in no way required for an attack, and is used for exploit development in the same way a debugger such as ollydbg would be used on a PC. Most modern cores have JTAG support built into the processor design.

Which architectures are affected?

Barnaby Jack: ARM and XScale architectures, and likely the PowerPC architecture. The MIPS processor maps the vectors to a high address, and is not susceptible to this exploitation method. Any architecture that stores the vector table at 0x0 would be vulnerable to this attack.

Can we consider this a hardware design problem?

Barnaby Jack: This could be considered more of a problem in the architecture design. The MIPS architecture for example bases the exception vectors at a high address, at 0x8000xxxx. Thankfully, with ARM, XScale, and PowerPC - there is an option to map the vectors to a high address.

On ARM9 and newer cores, the exception table can be relocated high by driving the HIVECS processor pin high. On the XScale core, the vectors can be relocated high by setting the Exception Vector Relocation Bit of the ARM control register to 1. The vectors will be mapped to address 0xFFFF0000.

Manufacturers of networked devices could issue a firmware update to remap the vectors to high memory.

I saw a thread on the dailydave mailing list, where Brad Spengler posted: "I submit for your record-keeping what I believe to be the first public exploit for a null ptr dereference bug in the Linux kernel." It seems they are talking about x86 too?

Barnaby Jack: There have been examples of NULL pointer exploitation on a variety of architectures and platforms, including a locally exploitable vulnerability in pt_chmod from 1994 found by 8lgm. More recently, skape wrote a paper on exploiting NULL pointers in Internet Explorer.

The Vector Rewrite Attack is not the first time a NULL pointer dereference has been manipulated to cause an exploitable vulnerability - but I haven't been made aware of any published vulnerabilities that use the NULL address to overwrite interrupt entries to gain execution control. What I like about the Vector Rewrite Attack, is the fact that it can be leveraged both locally and remotely and is 100 per cent reliable - it also affects the most popular embedded architectures.

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.