Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OS X 10.10.5 kernel local privilege escalation

github.com

Post reply on HN
Print view View original

121–130 of 143 posts

Re: OS X 10.10.5 kernel local privilege escalation

#121

Post by qwertyoruiop »

bro-stick wrote: post #57
qwertyoruiop wrote: post #50

Earlier quoted context omitted.

If the heap info leak fails, I bail out cleanly. If the kASLR leak fails, it is usually because instead of hitting a vm_map_copy (the intended structure I need to corrupt), something completely unrelated is hit instead. If it happens to hit something different than expected, that's undefined behaviour usually ending up in a panic.

Mad props. If osx were s/xnu/minix 3-style, full microkernel/, sploiting Iokit as a least priv'd process, only it would get pwned and be limited to iokit's acls. Still bad, but it likely wouldnt have rights to exec a root shell. XNU kexts have way too much authority, and all the syscalls they each tack on compounds the attack surface to the total codebases of all Apple and third-party kexts. Because once you've found…

while I agree with you on the security benefits of a full microkernel, to be entirely honest, if you had access to just IOKit you could easily use a network card or an hard drive controller to get a physical memory write-what-where, which in turn would allow you to gain access to anything, plus the microkernel performance issues of e.g. having to context switch on interrupts.

Re: OS X 10.10.5 kernel local privilege escalation

#122

Post by mikeash »

qwertyoruiop wrote: post #117
mikeash wrote: post #110

Earlier quoted context omitted.

Maybe Saturday afternoon just happened to be when he finished. And no, it's not like throwing a rock through somebody's window. The information may be used by other people to cause damage, but the mere act of releasing it is not by itself damaging. Let's put blame where it belongs: on the people actually using exploits for bad purposes. If you want to encourage responsible disclosure, don't lead with bad analogies ab…

for the record: i had no idea yesterday was saturday at the time I dropped the code.

Nothing says "hardcore hacker at work" quite like forgetting what day of the week it is.

Re: OS X 10.10.5 kernel local privilege escalation

#123

Post by scintill76 »

qwertyoruiop wrote: post #116
MagerValp wrote: post #112

Earlier quoted context omitted.

Thank you. Any particular reason you decided to lead with the exploit and not this patch?

I did not have the patch ready when the exploit was published, that's the only reason why. I had my reasons to publish the exploit in public yesterday, but all I can say is "no comment". Just for the record: I did inform Apple beforehand. Not so much before, but before. I do not consider this to be their fault in any way as someone in this thread seems to be implying. Again, I had my reasons to drop such a thing publ…

The video mentions iOS being vulnerable (around 1:00), but the exploit doesn't mention it. How vulnerable is iOS?

Re: OS X 10.10.5 kernel local privilege escalation

#124

Post by qwertyoruiop »

scintill76 wrote: post #123
qwertyoruiop wrote: post #116

Earlier quoted context omitted.

I did not have the patch ready when the exploit was published, that's the only reason why. I had my reasons to publish the exploit in public yesterday, but all I can say is "no comment". Just for the record: I did inform Apple beforehand. Not so much before, but before. I do not consider this to be their fault in any way as someone in this thread seems to be implying. Again, I had my reasons to drop such a thing publ…

The video mentions iOS being vulnerable (around 1:00), but the exploit doesn't mention it. How vulnerable is iOS?

iOS is vulnerable too as far as the vulnerability is concerned. It is not directly exploitable on iOS, however having a NULL task_t still does give you some abilities, even if not (directly?) SVC code exec.

Re: OS X 10.10.5 kernel local privilege escalation

#125

Post by MagerValp »

qwertyoruiop wrote: post #116
MagerValp wrote: post #112

Earlier quoted context omitted.

Thank you. Any particular reason you decided to lead with the exploit and not this patch?

I did not have the patch ready when the exploit was published, that's the only reason why. I had my reasons to publish the exploit in public yesterday, but all I can say is "no comment". Just for the record: I did inform Apple beforehand. Not so much before, but before. I do not consider this to be their fault in any way as someone in this thread seems to be implying. Again, I had my reasons to drop such a thing publ…

That restores some of my faith in humanity, thank you. We'll be looking at the kext today at work, but due to Apple's kext signing requirements I don't know how feasible it is to roll it out.

Re: OS X 10.10.5 kernel local privilege escalation

#126

Post by Arkanta »

klapinat0r wrote: post #97
klapinat0r wrote: post #86

Earlier quoted context omitted.

One of the vulns in this exploit is fixed, rendering the exploit "useless" in 10.11. But start the mac hate train regardless - if facts don't count :)

Why the massive downvotes when contributing to the issue he raises? > Apple appears to be in no rush to fix the first one, I wouldn't bet my money on this vulnerability getting a fix any time soon, either ... As it was clearly stated, there is a fix. Whether or not they'll release a 10.10 patch remains to be shown, and "no rush" is speculation. I'll never understand the HN crowd, but I guess providing additional info…

>Whether or not they'll release a 10.10 patch remains to be shown

10.10.3, which includes that fix, was released 3 days ago. I'll never understand the HN crown, whining about the HN crowd while you didn't bother googling before writing your rant.

Re: OS X 10.10.5 kernel local privilege escalation

#127

Post by qwertyoruiop »

MagerValp wrote: post #125
qwertyoruiop wrote: post #116

Earlier quoted context omitted.

I did not have the patch ready when the exploit was published, that's the only reason why. I had my reasons to publish the exploit in public yesterday, but all I can say is "no comment". Just for the record: I did inform Apple beforehand. Not so much before, but before. I do not consider this to be their fault in any way as someone in this thread seems to be implying. Again, I had my reasons to drop such a thing publ…

That restores some of my faith in humanity, thank you. We'll be looking at the kext today at work, but due to Apple's kext signing requirements I don't know how feasible it is to roll it out.

I have asked on Twitter if anyone could sign it for me. For some reason neither of the two people who tried to do so were able to sign it. No idea why. kexts were signed but they kept getting rejected for some reason.

Re: OS X 10.10.5 kernel local privilege escalation

#128

Post by MagerValp »

qwertyoruiop wrote: post #127
MagerValp wrote: post #125

Earlier quoted context omitted.

That restores some of my faith in humanity, thank you. We'll be looking at the kext today at work, but due to Apple's kext signing requirements I don't know how feasible it is to roll it out.

I have asked on Twitter if anyone could sign it for me. For some reason neither of the two people who tried to do so were able to sign it. No idea why. kexts were signed but they kept getting rejected for some reason.

You need a developer ID with kext signing ability, not a regular developer ID:

https://www.google.com/search?num=30&q=site%3Adeveloper.appl...

Re: OS X 10.10.5 kernel local privilege escalation

#129

Post by klapinat0r »

Arkanta wrote: post #126
klapinat0r wrote: post #97

Earlier quoted context omitted.

Why the massive downvotes when contributing to the issue he raises? > Apple appears to be in no rush to fix the first one, I wouldn't bet my money on this vulnerability getting a fix any time soon, either ... As it was clearly stated, there is a fix. Whether or not they'll release a 10.10 patch remains to be shown, and "no rush" is speculation. I'll never understand the HN crowd, but I guess providing additional info…

>Whether or not they'll release a 10.10 patch remains to be shown 10.10.3, which includes that fix, was released 3 days ago. I'll never understand the HN crown, whining about the HN crowd while you didn't bother googling before writing your rant.

I'm sorry, where's the rant?

I didn't know there was a 10.10.3 patch - I never said there wasn't. OP said there wasn't, I said it remains to be shown. You're more than welcome to correct me on that.

I don't understand what my patch sentence has to do with whining - or how that is whining about the HN crowd?

It's still unclear what was unwanted about my original comment, so I can't really correct my behavior (which was what I wanted all along).

Re: OS X 10.10.5 kernel local privilege escalation

#130

Post by amluto »

Ded7xSEoPKYNsDd wrote: post #79
nnx wrote: post #54

Earlier quoted context omitted.

Intriguing. Thanks for sharing. Doesn't Linux perform this "context switch at every syscall" ? How does it get away with the performance penalty?

On Linux, if you have a look at /proc/ /maps, you'll see a 'vsyscall' section mapped into every program. That section has code stubs for each syscall. For some simple syscalls like gettimeofday() (not sure there are any others) just return the current time, which is stored somewhere in that area. For other syscalls, the stubs use the best method to enter the kernel (sysenter vs. int 80) available on your specific pro…

There were only ever "vsyscall" entries for three syscalls: time, gettimeofday, and getcpu.

On recent kernels, the vsyscalls are actually the slowest way of all to ask for the time or the cpu number. They're only supported at all as a fallback, and the fallback is very slow, because it tries to mitigate exploit risks due to having code at a fixed address.

https://lwn.net/Articles/446528/

Post reply on HN