{"action":"created","issue":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/29","labels_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/29/labels{/name}","comments_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/29/comments","events_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/29/events","html_url":"https://github.com/chrsmith/google-security-research/issues/29","id":58936265,"number":29,"title":"OS X IOKit kernel code execution due to off-by-one error in IGAccelGLContext::processSidebandToken","user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/auto-migrated","name":"auto-migrated","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CVE-2014-4395","name":"CVE-2014-4395","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Deadline-90","name":"Deadline-90","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Deadline-Exceeded","name":"Deadline-Exceeded","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Finder-ianbeer","name":"Finder-ianbeer","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Fixed-2014-Sep-17","name":"Fixed-2014-Sep-17","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Id-606959356","name":"Id-606959356","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Product-OSX-Kernel","name":"Product-OSX-Kernel","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/PublicOn-2014-Sep-9","name":"PublicOn-2014-Sep-9","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Reported-2014-Jun-10","name":"Reported-2014-Jun-10","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Severity-High","name":"Severity-High","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Vendor-Apple","name":"Vendor-Apple","color":"ededed"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-02-25T17:13:20Z","updated_at":"2015-02-25T17:13:21Z","closed_at":"2015-02-25T17:13:20Z","body":"```\nThe Intel GPU driver uses shared memory for drawing commands. The userspace\nclient of the driver calls IOConnectMapMemory to map a shared page which it \nwill use,\ncalling selector 2 (submit_data_buffers) to signal to the driver that it should\nconsume the commands (tokens) written there by the client.\n\nThe function IGAccelGLContext::processSidebandToken checks the token ID and \nlength then\njumps to the function responsible for actually parsing the token:\n\n; IGAccelGLContext::processSidebandToken(IOAccelCommandStreamInfo &)\n       push    rbp\n       mov     rbp, rsp\n       mov     ax, [rsi+18h]   ; this is the token id\n       test    ax, ax\n       jns     short not_us    ; jump if not sign - token must be >= 0x8000\n       cmp     ax, 0A1FFh   \n       ja      short err       ; jump if token > 0xa1ff\n       movzx   ecx, ax         ; otherwise, take the upper 8 bits, subtract 0x80 and use as an index into s_cTokenInfo array of token function descriptors\n       mov     r8, [rdi+1090h] ; \n       shr     ecx, 8\n       add     ecx, 0FFFFFF80h\n       lea     rcx, [rcx+rcx*2]\n       mov     edx, [r8+rcx*8+10h] ; get pointer to descriptor\n\ns_cTokenInfo points to an array of 0x21 descriptors (each 0x18 bytes) therefore \nthe maximum index allowed should be 0x20. Supplying a token\nwith a token id field of 0xa100 will read a descriptor off the end of the \ns_cTokenInfo array. The bytes following the array happen to be zero, which means\nthat the code will reach a jmp rax where rax is zero.\n\nExploitability depends on two things: being able to map the zero page and being \nable to execute it - mapping the zero page is possible (see previous\nbug reports) but SMEP (Supervisor Mode Execution Prevention) will stop \nexploitation of this for Ivy Bridge and newer cpus. On Sandy Bridge and older \nhardware\nthis bug will be exploitable (eg MacBookPro <= 8,3 which so far as I understand \nis still completely supported hardware.)\n```\n\n-----\nOriginal issue reported on code.google.com by `ianb...@google.com` on 10 Jun 2014 at 12:06\n\nAttachments:\n* [ig_token_off_by_one.c](https://storage.googleapis.com/google-code-attachments/google-security-research/issue-29/comment-0/ig_token_off_by_one.c)\n"},"comment":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/comments/76005547","html_url":"https://github.com/chrsmith/google-security-research/issues/29#issuecomment-76005547","issue_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/29","id":76005547,"user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"created_at":"2015-02-25T17:13:21Z","updated_at":"2015-02-25T17:13:21Z","body":"```\nDeadline exceeded -- automatically derestricting\n```\n\n-----\nOriginal comment by `cev...@google.com` on 10 Sep 2014 at 12:57\n* Added labels: **Reported-2014-Jun-10**, **Deadline-Exceeded**, **PublicOn-2014-Sep-9**\n* Removed labels: **Restrict-View-Commit**, **Reported-2014-June-10**"}}