Kernel RCE in iOS/macOS with ICMP

Post by sigjuice » Thu, Nov 01, 2018, 8:56 AM UTC

geogriffin wrote: post #36

wepple wrote: post #4

Can someone explain to me, did I miss the description of the actual bug here? I get there’s a copy, but why is there an under-allocation to start with? Or is that alloc somehow attacker-controlled? Was part of the copy func args controllable? Or was this just an ad?

Pretty sure it was introduced here: https://github.com/apple/darwin-xnu/commit/c10988c130af09087... In this commit a bunch of code was copy-pasted from BSD into ip_icmp.c in icmp_error() to quote IP packet data in icmp error responses. Unfortunately they forgot to copy a line from the BSD source which would prevent the overflow: icmplen = min(icmplen, M_TRAILINGSPACE(m) - sizeof(struct ip) - ICMP_MINLEN); m is alloca…

Post by pjmlp » Thu, Nov 01, 2018, 9:22 AM UTC

pcwalton wrote: post #35

lunixbochs wrote: post #26

Earlier quoted context omitted.

Really? I found Skia easier to compile than actually use.

It's probably gotten better lately. A few years ago it took me several days to get it built.

Post by pjmlp » Thu, Nov 01, 2018, 9:27 AM UTC

lunixbochs wrote: post #26

pcwalton wrote: post #17

Earlier quoted context omitted.

> I find it to be an extremely sad state of affairs when it requires scouring the internet for a blog post from a Darwin engineer to build an outdated XNU :( Large projects at companies tend to be hard to build, simply because it takes a lot of effort to make the build system for something so complex easy. If community contributions aren't particularly valued (which they aren't for XNU), then it's hard to internally…

Really? I found Skia easier to compile than actually use.

Post by pjmlp » Thu, Nov 01, 2018, 9:31 AM UTC

kiallmacinnes wrote: post #40

walrus01 wrote: post #22

How long until somebody builds a device that is basically a pwnplug, which joins wifi networks at major tech conferences, does an nmap for live IPs, and sends this to every device?

As an aside, well ran conference WiFi (and public WiFi in general) won't allow attendees to contact each other over the WiFi network - they will only allow traffic from end user devices towards the gateway, and won't allow hairpin routing on that gateway. I wish more public WiFi was well ran, as many of these same network attacks wouldn't have an opportunity to work in the first place.

Post by etatoby » Thu, Nov 01, 2018, 9:59 AM UTC

petre wrote: post #42

Is there a fix for older OSX or should I just install Linux on my 2011 iMac? Yosemite is already quite slow. OpenSuSE 13.2 was really fast on a same generation Mac Mini.