�ݺ�ߣ

CodeQL + DTrace = in XNU
HowtofindmultiplememorydisclosuresinXNUusingCodeQL

whoami
ArseniiKostromin
Securityresearcher
FocusonmacOSsecurity:userlandandkernel
Twitter@0x3C3E

Agenda
KernelMemoryDisclosure,my and bugsinXNU

Motivation
AppleintervieweraskedmeseveraltimeswhyIdon'tlookforbugsinthekernel
Is it hard for you?
Before December 2022 ,Ihaven'tlookedintothe XNU sourcecode
4

CodeQL + DTrace = Memory Disclosure Vulnerabilities in XNU

Myapproach
Searchonlineandtagwriteups
Prepareadebuggingenvironment
UseCodeQLtosearchforsomepatterns
7

Some easy bugsinXNU
AtaleofasimpleApplekernelbug
Weggliwasusedtofindaspecificpattern
FindingamemoryexposurevulnerabilitywithCodeQL
CodeQLwasused,theauthorfoundabugintheDTracemoduleofXNU
8

HowtodebugkernelonasingleM1laptop?
QEMUemulatesIntel-basedmacOS
DTrace,dynamictracingframeworkinXNU
9

DTrace
Releasedin 2005 byOracle
ApplemergeditintoXNUin 2007
Wasitthoroughlyaudited?
It'scomplexandhasitsemulatorin the kernel
#define DIF_OP_OR 1 /* or r1, r2, rd */
#define DIF_OP_XOR 2 /* xor r1, r2, rd */
...
#define DIF_OP_STRIP 80 /* strip r1, key, rd */
bsd/sys/dtrace.h 10

CodeQL
Frameworkfordoingstaticanalysis
Modelscodeasdata→database
Writelogic-basedSQL-likequeriestofindpatterns
11

BuildingaCodeQLdatabase
Havetocompiletheprogramwewanttoquery
Bydefault,somefilesweremissing
AgreatscripttobuildaCodeQLdatabaseforXNUbypwn0rz
12

Codepattern
IdecidedtolookforOOBissues.Forthat,Iwroteaquerytofindsuchcode,whichmeets
theconditionsbelow:
a >= b ,where a issigned,and b isnot
No a <= 0 and a < 0 checks
a isanarrayindex
13

a >= b ,where a issigned,and b isnot
from Variable arg
where exists(
GEExpr ge | ge.getLeftOperand() = arg.getAnAccess()
and ge.getLeftOperand().
getExplicitlyConverted().
getUnderlyingType().(IntegralType).isSigned()
and ge.getRightOperand().
getUnderlyingType().(IntegralType).isUnsigned()
)
select arg
14

No a < 0 and a <= 0 checks
from Variable arg
where not exists(
LTExpr le | le.getLeftOperand() = arg.getAnAccess()
and le.getRightOperand().getValue() = "0"
)
and not exists(
LEExpr le | le.getLeftOperand() = arg.getAnAccess()
)
select arg
15

a isanarrayindex
from Variable arg, ArrayExpr ae
where ae.getArrayOffset() = arg.getAnAccess()
select ae.getArrayOffset(),
ae.getEnclosingFunction()
16

Combined
where exists(
GEExpr ge | ge.getLeftOperand() = arg.getAnAccess()
and ge.getLeftOperand().
and ge.getRightOperand().
getUnderlyingType().(IntegralType).isUnsigned()
)
and not exists(
)
and not exists(
)
and ae.getArrayOffset() = arg.getAnAccess()
17

Thequeryproduces
20 results
Only 6 differentfunctions
18

fasttrap_pid_getargdesc
// args: (void *arg, dtrace_id_t id, void *parg, dtrace_argdesc_t *desc)
if (probe->ftp_prov->ftp_retired != 0 ||
desc->dtargd_ndx >= probe->ftp_nargs) {
desc->dtargd_ndx = DTRACE_ARGNONE;
return;
}
ndx = (probe->ftp_argmap != NULL) ?
probe->ftp_argmap[desc->dtargd_ndx] : desc->dtargd_ndx;
Docs:gettheargumentdescriptionforargs[X]
bsd/dev/dtrace/fasttrap.c 19

dtargd_ndx is int
typedef struct dtrace_argdesc {
...
int dtargd_ndx; /* arg number (-1 iff none) */
...
} dtrace_argdesc_t;
ftp_nargs is unsigned char
struct fasttrap_probe {
...
uint8_t ftp_nargs; /* translated argument count */
...
};
bsd/sys/dtrace.h,bsd/sys/fasttrap_impl.h 20

Bothsidesareconvertedto int
As desc->dtargd_ndx is int and probe->ftp_nargs is unsigned char
return;
}
If desc->dtargd_ndx < 0 ,then desc->dtargd_ndx >= probe->ftp_nargs isalways
false
21

OOBRead, desc->dtargd_ndx isanindex
If probe->ftp_argmap isn't null ,it'spossibletoreachthefirstexpressionanduse
desc->dtargd_ndx withvalueslessthan 0
22

Nodirectcallstothefunction
It'scalledasaC-style virtual function
23

dtrace_pops
typedef struct dtrace_pops {
...
void (*dtps_getargdesc)(void *arg, dtrace_id_t id, void *parg,
dtrace_argdesc_t *desc);
...
} dtrace_pops_t;
dtrace_pops_t
static dtrace_pops_t pid_pops = {
...
.dtps_getargdesc = fasttrap_pid_getargdesc,
...
};
bsd/sys/dtrace.h,bsd/dev/dtrace/fasttrap.c 24

dtps_getargdesc mightbeapointerto fasttrap_pid_getargdesc
prov->dtpv_pops.dtps_getargdesc(
prov->dtpv_arg,
probe->dtpr_id,
probe->dtpr_arg,
&desc
);
bsd/dev/dtrace/dtrace.c 25

Upperboundcheckin fasttrap_pid_getargdesc
return;
}
Comparingto -1 in dtrace_ioctl
if (desc.dtargd_ndx == DTRACE_ARGNONE)
return (EINVAL);
bsd/dev/dtrace/fasttrap.c,bsd/dev/dtrace/dtrace.c 26

Howtoleakout-of-boundsvalues?
str = probe->ftp_ntypes;
for (i = 0; i < ndx; i++) {
str += strlen(str) + 1;
}
(void) strlcpy(desc->dtargd_native, str, sizeof(desc->dtargd_native));
Wecontrolintegerindex desc->dtargd_ndx andarrayof null delimitedstrings
probe->ftp_ntypes (arrayofchars)
Wehavetoleak probe->ftp_argmap[desc->dtargd_ndx] ( ndx isinteger)value
into desc->dtargd_native
27

Theidea
str = probe->ftp_ntypes; // { 1, 1, 0, 1, 0, 2, 0, 3, 0, ...}
for (i = 0; i < ndx; i++) { // ndx is a value to leak
}
Wecouldpopulate probe->ftp_ntypes withanarrayofnulldelimitedstrings
[1, 1, 0, 1, 0, 2, 0, 3, 0, ..., 255] from0to255(showedasbytes)
Encode 0 forexampleas [1, 1, 0] ,soit'scopiedtotheuserland
Then ndx equalstovaluein str
Specialcase— 0 is "x01x01x00"
28

ndx = 0
for (i = 0; i < ndx; i++) { // ^
}
// str points to "x01x01x00"
ndx = 1
for (i = 0; i < ndx; i++) { // ^
}
// str points to "x01x00"
29

Howtoreach?
_dtrace_ioctl → DTRACEIOC_PROBEARG switchcase→ fasttrap_pid_getargdesc
30

CVE-2023-27941
Kernel
Available for: macOS Ventura
Impact: An app may be able to disclose kernel memory
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed with improved input
validation.
Details
Thebugallowsreadingdatabytebybyteinarangeof2GB
Requiresrootaccess
31

Patch
Reversed fasttrap_pid_getargdesc changes
desc->dtargd_ndx < 0 || // added
return;
}
Applehasn'treleasedthenew XNU sourcecode
32

Codepattern
a < b ,where a issigned
Thecomparisonabovehappensin IfStmt
No a <= 0 and a < 0 checks
a isanarrayindex
34

a < b ,where a issigned,happensin IfStmt
from Variable arg
where exists(
LTExpr le |
le.getLeftOperand() = arg.getAnAccess()
and le.getParent() instanceof IfStmt
and le.getLeftOperand().
)
select arg
IfStmt is if (a < b) {} ,butnot a < b in for (a = 0; a < b; a++)
35

No a < 0 and a <= 0 checks
from Variable arg
where not exists(
)
and not exists(
)
select arg
36

a isanarrayindex
where ae.getArrayOffset() = arg.getAnAccess()
37

Filterresultsbyafilepath
from ArrayExpr ae
where ae.getFile().getAbsolutePath().
matches("%/xnu-build/xnu/%")
and not ae.getFile().getAbsolutePath().
matches("%/xnu-build/xnu/SETUP/%")
38

Combined
where exists(
LTExpr le |
le.getLeftOperand() = arg.getAnAccess()
and le.getParent() instanceof IfStmt
and le.getLeftOperand().
)
and not exists(
)
and not exists(
)
and ae.getArrayOffset() = arg.getAnAccess()
and ae.getFile().getAbsolutePath().matches("%/xnu-build/xnu/%")
and not ae.getFile().getAbsolutePath().matches("%/xnu-build/xnu/SETUP/%")
39

Thequeryproduces
169 results
Only 45 differentfunctions
40

OOBRead, argno isanindexon arm64
uint64_t
fasttrap_pid_getarg(void *arg, dtrace_id_t id, void *parg, int argno,
int aframes)
{
arm_saved_state_t* regs = find_user_regs(current_thread());
/* First eight arguments are in registers */
if (argno < 8) {
return saved_state64(regs)->x[argno];
}
Docs:getthevalueforanargXorargs[X]variable
bsd/dev/arm64/fasttrap_isa.c 41

OOBRead, argno isanindexon x86_64
uint64_t
fasttrap_pid_getarg(void* arg, dtrace_id_t id, void* parg, int argno,
int aframes)
{
pal_register_cache_state(current_thread(), VALID);
return (fasttrap_anarg(
(x86_saved_state_t*)find_user_regs(current_thread()),
1,
argno));
}
fasttrap_anarg
// args: (x86_saved_state_t *regs, int function_entry, int argno)
if (argno < 6)
return ((&regs64->rdi)[argno]);
bsd/dev/i386/fasttrap_isa.c,bsd/dev/i386/fasttrap_isa.c 42

dtrace_pops
typedef struct dtrace_pops {
...
uint64_t (*dtps_getargval)(void *arg, dtrace_id_t id, void *parg,
int argno, int aframes);
...
} dtrace_pops_t;
dtrace_pops_t
static dtrace_pops_t pid_pops = {
...
.dtps_getargval = fasttrap_pid_getarg,
...
};
bsd/dev/dtrace/fasttrap.c 43

dtps_getargval mightbeapointerto fasttrap_pid_getarg
// func: dtrace_dif_variable
// args: (dtrace_mstate_t *mstate, dtrace_state_t *state, uint64_t v,
// uint64_t ndx)
val = pv->dtpv_pops.dtps_getargval(pv->dtpv_arg,
mstate->dtms_probe->dtpr_id,
mstate->dtms_probe->dtpr_arg, ndx, aframes);

Boundscheck?
// func: dtrace_dif_variable
// args: (dtrace_mstate_t *mstate, dtrace_state_t *state, uint64_t v,
// uint64_t ndx)
if (ndx >= sizeof (mstate->dtms_arg) / sizeof (mstate->dtms_arg[0])) {
...
dtrace_provider_t *pv;
uint64_t val;
pv = mstate->dtms_probe->dtpr_provider;
if (pv->dtpv_pops.dtps_getargval != NULL)
ndx isan unsigned long long ,laterit'sconvertedintoan int in
fasttrap_pid_getarg , argno argument
45

Howtoreach?
dtrace_dif_emulate → DIF_OP_LDGA opcode→ dtrace_dif_variable →
fasttrap_pid_getarg
46

AnoldPoChelpedtotriggerthevulnerablefunction
AlmostthesamecodeflowasinCVE-2017-13782byKevinBackhouse
Butyouhavetousea fasttrap provider,whichallowstracinguserlandfunctions
It'spossibletodefineafunction void foo() {}
TraceitusingDTrace: pid$target::foo:entry { ... }
47

Codeflowdifference
mstate->dtms_probe->dtpr_arg, ndx, aframes); // CVE-2023-28200
...
else
val = dtrace_getarg(ndx, aframes, mstate, vstate); // CVE-2017-13782
9 linesdifference

CVE-2023-28200
Kernel
Available for: macOS Ventura
Impact: An app may be able to disclose kernel memory
Description: A validation issue was addressed with improved input
sanitization.
Details
Thebugallowsreadingdatainarangeof16GB
Requiresrootaccess
49

Patch
Reversed dtrace_dif_variable changes
if (ndx >= sizeof (mstate->dtms_arg) / sizeof (mstate->dtms_arg[0])) {
if ((ndx & 0x80000000) != 0) return 0; // added
...
dtrace_provider_t *pv;
uint64_t val;
Additionalcheckaddedincallerfunction
Calleefunctionsareunfixedforsomereason
50

Why?
root access!= kernel accessonmacOS
SIP putsthewholesystemintoasandbox
even root can'tloaduntrustedkernelextensions
+Ihad App Sandbox Escape → user to root LPEchain
52

PoCs
CVE-2023-27941matcheskerneladdressesfromleakeddata
CVE-2023-28200onlypanicsthekernel
53

Conclusion
Applehastomaintaintwoarchitectures: x86_64 and arm64
C-like virtual functions make static analysisharder
54

Resources
Realhackersdon'tleaveDTrace
FindingamemoryexposurevulnerabilitywithCodeQL
ThereisnoSinmacOSSIP
55

�ݺ�ߣ

CodeQL + DTrace = Memory Disclosure Vulnerabilities in XNU

Recommended

More Related Content

Similar to CodeQL + DTrace = Memory Disclosure Vulnerabilities in XNU (20)

Recently uploaded (20)

CodeQL + DTrace = Memory Disclosure Vulnerabilities in XNU