IOSurface Kernel Exploit - Revision history

Jacob: Added CVE (hopefully the right one) and Category

2011-07-09T20:22:50Z

Added CVE (hopefully the right one) and Category

Jacob at 02:17, 19 October 2010

2010-10-19T02:17:57Z

Jacob: Grammar fixes

2010-10-19T02:06:28Z

Grammar fixes

Dialexio at 00:43, 19 October 2010

2010-10-19T00:43:14Z

C0d3r at 20:07, 13 October 2010

2010-10-13T20:07:18Z

Redart at 12:26, 13 October 2010

2010-10-13T12:26:43Z

Liamchat: i think it is correct

2010-10-12T20:33:57Z

i think it is correct

New page

This vulnerability, along with the [[Malformed_CFF_Vulnerability]], was used in [[Star]]/[[JailbreakMe]] 2.0. It is a buffers overflow in the handling of the [http://iphonedevwiki.net/index.php/IOCoreSurfaceRoot kernel-extension for managing pixel buffers] however mobilesafari run's as mobile so in order to use this exploit you need to get root permission this is achieved by the [[Incomplete_Codesign_Exploit]]

== exploit ==

Selector 19 was Vulnerability to a buffers overflow that allow access to the root filesystem without making the kernel fail signature checks

{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! Selector !! Action !! Input !! Output
|-
| 0 || lookupFromMachPort || - || 1,208 bytes of stuff
|-
| 1 || release || IOSurfaceID ''surfaceID'' || -
|-
| 2 || lock || struct IOSurfaceLockArg || 1,208 bytes of stuff
|-
| 3 || unlock || struct IOSurfaceLockArg || struct IOSurfaceLockSeedArg
|-
| 4 || lockPlane || struct IOSurfaceLockArg || 1,208 bytes of stuff
|-
| 5 || unlockPlane || struct IOSurfaceLockArg || struct IOSurfaceLockSeedArg
|-
| 6 || lookup || void* ''???'' || 1,208 bytes of stuff
|-
| 7 || setYCbCrMatrix || IOSurfaceID ''surfaceID'', uint32_t ''YCbCrMatrix'' || -
|-
| 8 || wrapClientImage || 28 bytes of stuff || 1,208 bytes of stuff
|-
| 9 || wrapClientMemory || void* ''param0'', void* ''param1'' || 1,208 bytes of stuff
|-
| 10 || getYCbCrMatrix || IOSurfaceID ''surfaceID'' || uint32_t ''YCbCrMatrix''
|-
| 11 || setValue || ? || -
|-
| 12 || getValueMethod || ? || ?
|-
| 13 || kIOSurfaceMethodRemoveValue || ? || -
|-
| 14 || bindAccel || IOSurfaceID ''surfaceID'', void* ''unknown0'', void* ''unknown4'' || -
|-
| 15 || bindAccelOnPlane || IOSurfaceID ''surfaceID'', void* ''param1'', void* ''param2'', size_t ''planeIndex'' || -
|-
| 16 || readLimits || - || 20 bytes of stuff.
|-
| 17 || kIOSurfaceMethodIncrementUseCount || IOSurfaceID ''surfaceID'' || -
|-
| 18 || kIOSurfaceMethodDecrementUseCount || IOSurfaceID ''surfaceID'' || -
|-
| 19 || ? || void* ''???'' || void* ''???''
|-
| 20 || setSurfaceNotify || 24 bytes of stuff || -
|-
| 21 || removeSurfaceNotify || 24 bytes of stuff || -
|}

== Credit ==
[[User:Comex|comex]]

← Older revision		Revision as of 20:22, 9 July 2011
Line 56:		Line 56:
	\| 21 \|\| removeSurfaceNotify \|\| 24 bytes of stuff \|\| -		\| 21 \|\| removeSurfaceNotify \|\| 24 bytes of stuff \|\| -
	\|}		\|}
		+	== Sources ==
		+	*http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2973
		+	[[Category:Exploits]]

@@ Line 6: / Line 6: @@
 == Exploit ==
-Selector 19 was Vulnerable to a buffer overflow that would allow access to the root filesystem without making the kernel fail signature check
+Selector 19 was vulnerable to a buffer overflow that would allow access to the root filesystem without making the kernel fail signature check
 {| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"

@@ Line 6: / Line 6: @@
 == Exploit ==
-Selector 19 was Vulnerability to a buffer overflow that allow access to the root filesystem without making the kernel fail signature check
+Selector 19 was Vulnerable to a buffer overflow that would allow access to the root filesystem without making the kernel fail signature check
 {| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"

@@ Line 1: / Line 1: @@
-This vulnerability, along with the [[Malformed_CFF_Vulnerability]], was used in [[Star]]/[[JailbreakMe]] 2.0. It is a buffers overflow in the handling of the [http://iphonedevwiki.net/index.php/IOCoreSurfaceRoot kernel-extension for managing pixel buffers] used to get root privileges.
+This vulnerability, along with the [[Malformed CFF Vulnerability]], was used in [[Star]]/[[JailbreakMe]] 2.0. It is a buffer overflow in the handling of the [http://iphonedevwiki.net/index.php/IOCoreSurfaceRoot kernel-extension for managing pixel buffers] used to get root privileges.
-== exploit ==
+== Exploit ==
 Selector 19 was Vulnerability to a buffer overflow that allow access to the root filesystem without making the kernel fail signature check
@@ Line 54: / Line 56: @@
 | 21 || removeSurfaceNotify || 24 bytes of stuff || -
 |}

← Older revision		Revision as of 12:26, 13 October 2010
Line 1:		Line 1:
−	This vulnerability, along with the [[Malformed_CFF_Vulnerability]], was used in [[Star]]/[[JailbreakMe]] 2.0. It is a buffers overflow in the handling of the [http://iphonedevwiki.net/index.php/IOCoreSurfaceRoot kernel-extension for managing pixel buffers] ~~however mobilesafari run's as mobile so in order to use this exploit you need~~ to get root ~~permission this is achieved by the [[Incomplete_Codesign_Exploit]]~~	+	This vulnerability, along with the [[Malformed_CFF_Vulnerability]], was used in [[Star]]/[[JailbreakMe]] 2.0. It is a buffers overflow in the handling of the [http://iphonedevwiki.net/index.php/IOCoreSurfaceRoot kernel-extension for managing pixel buffers] used to get root privileges.