{"action":"created","issue":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/80","labels_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/80/labels{/name}","comments_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/80/comments","events_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/80/events","html_url":"https://github.com/chrsmith/google-security-research/issues/80","id":58936526,"number":80,"title":"OS X coresymbolicationd multiple user to root privilege escalations due to XPC type confusion","user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/auto-migrated","name":"auto-migrated","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CCProjectZeroMembers","name":"CCProjectZeroMembers","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CVE-2014-8817","name":"CVE-2014-8817","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Deadline-90","name":"Deadline-90","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Deadline-Exceeded","name":"Deadline-Exceeded","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Finder-ianbeer","name":"Finder-ianbeer","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Fixed-2015-Jan-27","name":"Fixed-2015-Jan-27","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Id-608677976","name":"Id-608677976","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Product-OSX","name":"Product-OSX","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Reported-2014-Jul-30","name":"Reported-2014-Jul-30","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Severity-High","name":"Severity-High","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Vendor-Apple","name":"Vendor-Apple","color":"ededed"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-02-25T17:14:19Z","updated_at":"2015-02-25T17:14:21Z","closed_at":"2015-02-25T17:14:19Z","body":"```\ncoresymbolicationd is an on-demand xpc service running as root with the service \nname \"com.apple.coresymbolicationd\".\n\nThe coresymbolicationd commands match_mmap_archives, delete_mmap_archives, \nwrite_mmap_archive and read_mmap_archive all perform insufficient type \nvalidation of xpc_object_t's:\n\nThe top level type of an xpc message is a dictionary, the function at \n__text:0000000100001620 in coresymbolicationd is responsible for parsing this \ndictionary and sending any reply messages.\n\nThe value of the key \"cmd\" is a uint64 which determines the intended command. \nFor messages with a cmd value of 2 or 3 (match_mmap_archives and \ndelete_mmap_archives) coresymbolicationd will read a value from the top level \ndictionary with the key \"filters\". For messages with a cmd value of 4 or 5 \ncoresymbolicationd will read a value with the key \"entry\". In all these cases \ncoresymbolicationd uses the xpc_dictionary_get_value API which enforces no type \non the returned value (the value of these keys can be any xpc type.) The \nreturned object in each case is then used as an xpc array without checking that \nit is in fact an xpc array. From this array another array is read at offset 0 \nusing xpc_array_get_value.\n\nIt just so happens that the layout of xpc strings and arrays overlap in such a \nway that the string length field will be interpreted as the array length field \nand the string character data pointer will be interpreted as the array data \npointer - this means that we can craft a string such that the first 8 \ncharacters will be interpreted as a pointer to an xpc_object_t. This type is \njust an objective-c object (right?) - at the very least the subsequent \nxpc_retain call allows an arbitrary increment,\nand I'm pretty sure that you could get code execution by pointing to a fake \nobjective-c object with a cached \"_xref_dispose\" method. All the phrack \narticles are pretty out-of-date on objective-c internals though so I haven't \nplayed with this more yet.\n\nThis PoC will crash trying to increment the reference count of an object at \n0x4141414141414141.\n\neither attach to coresymbolicationd if it's running or get lldb to wait for it \nlike this:\n\n$ sudo lldb\n(lldb) process attach --name coresymbolicationd --waitfor\n\nthen run the attached PoC\n```\n\n-----\nOriginal issue reported on code.google.com by `ianb...@google.com` on 30 Jul 2014 at 5:28\n\nAttachments:\n* [coresymbolication_type_confusion.c](https://storage.googleapis.com/google-code-attachments/google-security-research/issue-80/comment-0/coresymbolication_type_confusion.c)\n"},"comment":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/comments/76005884","html_url":"https://github.com/chrsmith/google-security-research/issues/80#issuecomment-76005884","issue_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/80","id":76005884,"user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"created_at":"2015-02-25T17:14:20Z","updated_at":"2015-02-25T17:14:20Z","body":"\n\n-----\nOriginal comment by `ianb...@google.com` on 23 Sep 2014 at 7:16\n* Added labels: **Reported-2014-Jul-30**\n* Removed labels: **Reported-2014-July-30**"}}