{"id":13976,"date":"2018-12-02T14:19:07","date_gmt":"2018-12-02T22:19:07","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/12\/02\/news-7743\/"},"modified":"2018-12-02T14:19:07","modified_gmt":"2018-12-02T22:19:07","slug":"news-7743","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/12\/02\/news-7743\/","title":{"rendered":"SSD Advisory \u2013 iOS\/macOS Safari Sandbox Escape via QuartzCore Heap Overflow"},"content":{"rendered":"

Credit to Author: SSD \/ Ori Nimron| Date: Sun, 02 Dec 2018 13:08:59 +0000<\/strong><\/p>\n

\n
\n

Vulnerabilities Summary<\/strong>
QuartzCore ( https:\/\/developer.apple.com\/documentation\/quartzcore ), also known as CoreAnimation, is a framework use by macOS and iOS to build an animatable scene graph. CoreAnimation uses a unique rendering model where the graphics operations are run in a separate process. On macOS, the process is WindowServer and on iOS the name is backboardd. Both of these process are out of sandbox and have the right to call setuid. The service name QuartzCore is usually referenced as CARenderServer. This service exists on both macOS and iOS and can be accessed from the Safarisandbox and therefore has been used for Pwn2Own on many occasions.\u00a0There exists an integer overflow which can lead to heap over flow in QuartzCore on latest macOS\/iOS.<\/p>\n

Vendor Response<\/strong>
“CoreAnimation Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4415: Liang Zhuo working with Beyond Security\u2019s SecuriTeam Secure Disclosure”<\/p>\n

CVE<\/strong>
CVE-2018-4415<\/p>\n

Credit<\/strong>
An independent Security Researcher, Zhuo Liang,\u00a0has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program.
<\/span>
Affected systems<\/strong>
macOS 10.14
iOS 12.10<\/p>\n

Vulnerability Details<\/strong>
The root cause of this vulnerability lies in QuartzCore`CA::Render::InterpolatedFunction::InterpolatedFunction function, this function does not notice the case of integer overflow. In the
sections will discuss the details of this vulnerability on both macOS and iOS.<\/p>\n

macOS 10.14<\/strong>
On macOS, there is an useful API to retrive open the CARenderService named CGSCreateLayerContext(Not exists on iOS). The attacker can send messages to the service port with message id 0x9C42 or 0x9C43. When the process(server_thread, actually) receives this message of the specified message ids, it will go into a procedure like deserialization. With proper data fed the execution stream will go into function CA::Render::InterpolatedFunction::InterpolatedFunction.<\/p>\n

\"\"<\/a><\/p>\n

Notice at (a) and (b) the value of these two member can be controlled by attacker(CA uses functions like CA::Render::Decoder::decode* to deserialize objects), and in CA::Render::InterpolatedFunction::allocate_storage function, these values will be used to decide the size of memory to be allocate.<\/p>\n

\"\"<\/a><\/p>\n

At (d), v3 is controlled by values at (a) and (b). And v4 at (e) can also be controlled by attacker at (c). So the size of the memory to allocate is 4 * (v4 + v3). But look at (f) carefully, the third parameter passed to CA::Render::Decoder::decode_bytes is actually 4 * v3. The simplest form of CA::Render::Decoder::decode_bytes at (f) is like memcpy(v2, v8, 4 * v3) or memset(v2, 0, 4 * v3). So the heap overflow leading by integer overflow happens when 4 * (v4 + v3) overflows but 4 * v3 not. The proof combination of those attacker controlled values which can lead to proper integer overflow can be found in the exploit in the end of this advisory.<\/p>\n

Reproduction of this issue on macOS can be done as follows:
1. clang QuartzCoreFunctionIntOverFlow.c -o
quartz_core_function_over_flow -framework CoreGraphics
2. .\/quartz_core_function_over_flow<\/p>\n

\t\t<\/p>\n

\n
<\/span> \t\t\t<\/p>\n
\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n
<\/div>\n