Posix spawn kernel information leak - Revision history

Awesomebing1: Remove bold headings; typo fix

2016-01-24T00:34:47Z

Remove bold headings; typo fix

IAdam1n: Adding to exploits category.

2014-08-12T16:29:20Z

Adding to exploits category.

Aker: /* Links */

2014-06-05T08:15:18Z

‎Links

M2m: fixed small typo

2014-06-05T02:20:32Z

fixed small typo

I3ppwn: /* Links */

2014-06-04T19:30:16Z

‎Links

I3ppwn: /* Vulnerability */

2014-06-04T19:28:49Z

‎Vulnerability

Ra1ningSn0w at 19:27, 4 January 2014

2014-01-04T19:27:23Z

Ra1ningSn0w at 19:22, 4 January 2014

2014-01-04T19:22:54Z

Ra1ningSn0w at 19:13, 4 January 2014

2014-01-04T19:13:57Z

Ra1ningSn0w at 19:11, 4 January 2014

2014-01-04T19:11:40Z

@@ Line 1: / Line 1: @@
-Vulnerability used in [[p0sixspwn]]
+A vulnerability used in [[p0sixspwn]].
-== '''Vulnerability Part 1''' ==
+== Vulnerability Part 1 ==
-There is an information leak vulnerabilty, which can be exploited to retrieve leaked bytes from the kernel heap. If you carefully craft the data's size, you can leak bytes from the heap using a ''PSFA_OPEN'' file action. The Size is crafted so that the beginning of the file name is within the buffer and the rest is taken in the heap, then you can use ''fcntl(F_GETPATH)'' to get the leaked bytes.
+There is an information leak vulnerability, which can be exploited to retrieve leaked bytes from the kernel heap. If you carefully craft the data's size, you can leak bytes from the heap using a ''PSFA_OPEN'' file action. The Size is crafted so that the beginning of the file name is within the buffer and the rest is taken in the heap, then you can use ''fcntl(F_GETPATH)'' to get the leaked bytes.
-== '''Vulnerability Part 2''' ==
+== Vulnerability Part 2 ==
 The ''posix_spawn()'' vulnerability isn't just a way to leak memory, this is also a race condition exploit, but you need a way to re-read the memory, and then write outside the buffer, then finally you need to sync with a secondary thread via file locking. Like this ''open(...,    O_EXLOCK )''. The p0sixspwn jailbreak also utilizes another exploit to change the ''fd_ofileflags'' relocation path.
-== '''Credit''' ==
+== Credit ==
 [[I0n1c]]
-== '''Links''' ==
+== Links ==
 * [http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdf Writeup by i0n1c p. 20 ff.]

← Older revision		Revision as of 16:29, 12 August 2014
Line 17:		Line 17:
	* [http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdf Writeup by i0n1c p. 20 ff.]		* [http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdf Writeup by i0n1c p. 20 ff.]
	* [http://conference.hitb.org/hitbsecconf2013kul/materials/D2T2%20-%20Stefan%20Esser%20-%20Tales%20from%20iOS%206%20Exploitation%20and%20iOS%207%20Security%20Changes.pdf i0n1c's writeup]		* [http://conference.hitb.org/hitbsecconf2013kul/materials/D2T2%20-%20Stefan%20Esser%20-%20Tales%20from%20iOS%206%20Exploitation%20and%20iOS%207%20Security%20Changes.pdf i0n1c's writeup]
		+
		+	[[Category:Exploits]]

@@ Line 15: / Line 15: @@
 == '''Links''' ==
-[http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdf Writeup by i0n1c p. 20 ff.]
+* [http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdf Writeup by i0n1c p. 20 ff.]
-[http://conference.hitb.org/hitbsecconf2013kul/materials/D2T2%20-%20Stefan%20Esser%20-%20Tales%20from%20iOS%206%20Exploitation%20and%20iOS%207%20Security%20Changes.pdf  i0n1c's writeup]
+* [http://conference.hitb.org/hitbsecconf2013kul/materials/D2T2%20-%20Stefan%20Esser%20-%20Tales%20from%20iOS%206%20Exploitation%20and%20iOS%207%20Security%20Changes.pdf  i0n1c's writeup]

@@ Line 7: / Line 7: @@
 == '''Vulnerability Part 2''' ==
-The ''posix_spawn()'' vulnerability isn't just a way to leak memory, this is also a race condition exploit, but you need a way to re-read the memory, and then write outside the buffer, then finaally you need to sync with a secondary thread via file locking. Like this ''open(...,    O_EXLOCK )''. The p0sixspwn jailbreak also utilizes another exploit to change the ''fd_ofileflags'' relocation path.
+The ''posix_spawn()'' vulnerability isn't just a way to leak memory, this is also a race condition exploit, but you need a way to re-read the memory, and then write outside the buffer, then finally you need to sync with a secondary thread via file locking. Like this ''open(...,    O_EXLOCK )''. The p0sixspwn jailbreak also utilizes another exploit to change the ''fd_ofileflags'' relocation path.
 == '''Credit''' ==

← Older revision		Revision as of 19:30, 4 June 2014
Line 16:		Line 16:

	[http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdf Writeup by i0n1c p. 20 ff.]		[http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdf Writeup by i0n1c p. 20 ff.]
		+	[http://conference.hitb.org/hitbsecconf2013kul/materials/D2T2%20-%20Stefan%20Esser%20-%20Tales%20from%20iOS%206%20Exploitation%20and%20iOS%207%20Security%20Changes.pdf i0n1c's writeup]

@@ Line 3: / Line 3: @@
 == '''Vulnerability''' ==
-There is an information leak vulnerabilty, which can be exploited to retrieve leaked bytes from the kernel.
+There is an information leak vulnerabilty, which can be exploited to retrieve leaked bytes from the kernel heap.
 == '''Credit''' ==

@@ Line 4: / Line 4: @@
 There is a vulnerability in the method posix_spawn() in the XNU kernel. When it is used with the flag _POSIX_SPAWN_DISABLE_ASLR, it disables ASLR for the process running. On x86_64 processes it also disables heap randomization.
-Furthermore the flag _POSIX_SPAWN_ALLOW_DATA_EXEC enables execution on the heap
+<br/>Furthermore, the flag _POSIX_SPAWN_ALLOW_DATA_EXEC enables execution on the heap.
 == '''Credit''' ==

← Older revision		Revision as of 19:11, 4 January 2014
Line 1:		Line 1:
		+	Vulnerability used in [[p0sixspwn]]
		+
	== '''Vulnerability''' ==		== '''Vulnerability''' ==