Google's Project Zero reveals Apple jailbreak exploit

Holy Moley! iOS and MacOS were wholly holey

Ian Beer of Google's Project Zero has followed up on a “coming soon” Twitter teaser with a jailbreakable iOS and Mac OS vulnerability.

Beer went public after Apple worked out a fix for the kernel memory corruption bug.

He even launched a Twitter account for the occasion:

(For non-programmers: tfp0 stands for “task for pid 0” – the kernel task port, and therefore the vector for pwnage.)

The release is designed to let others take their own toolkits to Apple devices, ultimately to improve their security: if you don't need to jailbreak a device, Apple had already patched the bugs last week.

The issue Beer found starts with Apple's Mach kernel implementation, and the Mach interface generator (MIG). Beer was already familiar with MIG's behaviour, having turned up CVE-2016-7612 and CVE-2016-7633 last year, and in September 2016 wrote: “Exploitability hinges on being able to get the memory reallocated in between the two vm_deallocate calls, probably in another thread.”

A second bug detailed in Beer's proof-of-concept provided the vector to attack MIG. He writes that he took advantage of “a recent addition to the kernel, presumably as a debugging tool to help enumerate places where the kernel is accidentally disclosing pointers to userspace. The implementation currently enumerates kqueues and dumps a bunch of values from them.”

Beer's step-by-step explanation is in the readme file of his PoC (linked in the Project Zero post):

  • First, he used a proc_pidlistuptrs bug to disclose the address of arbitrary ipc_ports;
  • Second, he triggered an out-of-bounds read for “various kalloc sizes” to identify “the most commonly-leaked kernel pointer”;
  • Next, he sent Mach messages to gather “a pretty large number of kalloc allocations;
  • With enough Mach port allocations, Beer gathered a page “containing only my ports”. The port address disclosure provided “a port which fits within particular bounds on a page. Once I've found it, I use the IOSurface bug to give myself a dangling pointer to that port”;
  • ”I free the kalloc allocations made earlier and all the other ports then start making kalloc.4096 allocations (again via crafted mach messages);”
  • Careful reallocation (1 MB at a time) made garbage collection trigger and “collect the page that the dangling pointer points to”.

Beer continued that “the bsdinfo->pid trick” let him build an arbitary read to find the kernel task's vm_map and the kernel's ipc_space, allowing him to reallocate the kalloc.4096 buffer with a fake kernel task port.

Beer said he had tested the exploit on iPhone 6s, iPhone 7, iPod Touch 6G, and Mac OS 10.13 on a MacBook Air 5.2 ®

Sponsored: Minds Mastering Machines - Call for papers now open


Biting the hand that feeds IT © 1998–2018