Forest Global Training Partners

Cyber Risks · Google Project Zero

Exception-oriented exploitation on iOS

Summary: Project Zero's Ian Beer documented CVE-2017-2370, a heap buffer overflow in the mach_voucher_extract_attr_recipe_trap mach trap added in iOS 10, where a copy-paste error left copyin reading a userspace pointer as the copy length instead of the validated sz value. The bug lets an attacker make a kalloc heap allocation of 256 to 5120 bytes and overflow it with controlled data, and Beer describes chaining it toward corrupting the ikm_size field of ipc_kmsg structures for out-of-bounds reads and writes.

Key Takeaway: The trap was callable from every sandboxed process on the system, and the sandbox offered no protection before a mandatory access control hook that this code path never reached. The flaw came from a compiler suggestion accepted during a routine copy-paste, which is the kind of defect that ships in a kernel update and sits in every iPhone until patched.

Read the original at Google Project Zero ↗

Topics
Vulnerabilities & Patching
Mentions
CVE-2017-2370
Related