Just curious when you disclosed this to apple? I'm impressed by your skill in finding this, but not sure it is a good idea to make it so easy for people to weaponize like this.
OS X 10.10.5 kernel local privilege escalation
31–40 of 143 posts
Re: OS X 10.10.5 kernel local privilege escalation
#32Does anyone know if 10.9.5 is vulnerable?
Re: OS X 10.10.5 kernel local privilege escalation
#33Earlier quoted context omitted.
I can't reply to your post lower in the thread, but saying a java applet and flash app can exploit this? It's a C program that requires a local account on the box. You would need to break out of the java sandbox into local unprivileged shell access before you could exploit this via java. Same with flash - you would need a flash exploit that breaks you out of the sandbox before you can exploit this. In other words, yo…
Java applet and Flash 0days exist in the wild whether they're published or not. I am confident that 0days for them exist and are actively used right now. So you're going to tell me that this is a non-issue because it's "unexploitable"?
I think you spelled 'exploitable' wrong, since that's what I actually said when passing on my complements to the author above. I feel like I'm arguing with a dining room table.
Re: OS X 10.10.5 kernel local privilege escalation
#34Any way to protect a machine until apple publishes an update?
add -no_shared_cr3 to your boot-args.
it will have an hefty performance penalty, but if you value security over performance, it'll also protect you against a lot of (even 0day!) exploits.
Re: OS X 10.10.5 kernel local privilege escalation
#35Does anyone know if 10.9.5 is vulnerable?
Yes, it is.
Re: OS X 10.10.5 kernel local privilege escalation
#36Okay, this is really weird... after rooting, and pressing ^D or typing exit, I stay root
~/code/tpwn % id -u
503
~/code/tpwn % ./tpwn
leaked kaslr slide, @ 0x0000000005600000
sh-3.2# exit
exit
~/code/tpwn # id -u
0
Re: OS X 10.10.5 kernel local privilege escalation
#37Okay, this is really weird... after rooting, and pressing ^D or typing exit, I stay root ~/code/tpwn % id -u 503 ~/code/tpwn % ./tpwn leaked kaslr slide, @ 0x0000000005600000 sh-3.2# exit exit ~/code/tpwn # id -u 0 Edit: and it crashes iTerm2 after the last `id -u`. Managed to get a screenshot of what I'm talking about: http://i.imgur.com/foWgTBN.png
This does not happen for me.
bash-3.2$ ./tpwn
leaked kaslr slide, @ 0x000000000f800000
sh-3.2# exit
bash-3.2$ id -u
501Re: OS X 10.10.5 kernel local privilege escalation
#38Okay, this is really weird... after rooting, and pressing ^D or typing exit, I stay root ~/code/tpwn % id -u 503 ~/code/tpwn % ./tpwn leaked kaslr slide, @ 0x0000000005600000 sh-3.2# exit exit ~/code/tpwn # id -u 0 Edit: and it crashes iTerm2 after the last `id -u`. Managed to get a screenshot of what I'm talking about: http://i.imgur.com/foWgTBN.png
I replaces your user shell with a root shell. You're not "root" in that terminal.
Re: OS X 10.10.5 kernel local privilege escalation
#39Any way to protect a machine until apple publishes an update?
add -no_shared_cr3 to your boot-args. it will have an hefty performance penalty, but if you value security over performance, it'll also protect you against a lot of (even 0day!) exploits.
Could you provide some context for that? What does that flag do? How do you even set boot args for OSX? I have little context to OSX boot process, and would like to understand this better.
Re: OS X 10.10.5 kernel local privilege escalation
#40(1) Can I also ask how you found this?
Were you fuzzing Iokit?
(2) I'm trying to work through your ROP. Can you explain a bit more? Thanks.