MacOS sysctl default netsvctype to dscp map sysctl dscp to wifi ac map Stack Leak

Details
Category: Vulnerabilities
Hits: 447
MacOS sysctl_default_netsvctype_to_dscp_map and sysctl_dscp_to_wifi_ac_map stack leak through struct padding

CVE-2018-4093


The sysctls net.qos.default_netsvctype_to_dscp_m MacOS sysctl_default_netsvctype_to_dscp_map and sysctl_dscp_to_wifi_ac_map stack leak through struct padding

CVE-2018-4093


The sysctls net.qos.default_netsvctype_to_dscp_map and net.qos.dscp_to_wifi_ac_map, implemented in sysctl_default_netsvctype_to_dscp_map() and sysctl_dscp_to_wifi_ac_map(), write arrays of elements of type `struct netsvctype_dscp_map` from the stack to userspace. This struct type contains padding bytes:

/*
* Network Service Type to DiffServ Code Point mapping
*/
struct netsvctype_dscp_map {
int netsvctype;
u_int8_t dscp; /* 6 bits diffserv code point */
/* 3 bytes padding */
};


This issue was discovered using an AFL-based fuzzer, loosely based on TriforceAFL. These are the debug log diffs with different stack poison values (0xcc and 0xdd):

#### TESTCASE 'id:012874,src:012831,op:arith16,pos:30,val:be:+34,+cov'
[...]
loaded 68 bytes fuzzdata
[...]
syscall(rax=0x600020000ca, args=[0x3, 0x3, 0x3, 0xea800f00000069, 0x10003, 0x0]); rsp=0x7ffee8bc9da8
USER READ: addr 0x3, size 8, value 0x0000007200000004
USER READ: addr 0xb, size 1, value 0x65
USER READ: addr 0xc, size 1, value 0x00
USER READ: addr 0xd, size 1, value 0x00
USER READ: addr 0xe, size 1, value 0x00
-USER WRITE: addr 0x3, size 8, value 0xcccccc0000000000
-USER WRITE: addr 0xb, size 8, value 0xcccccc0a00000001
-USER WRITE: addr 0x13, size 8, value 0xcccccc1800000002
-USER WRITE: addr 0x1b, size 8, value 0xcccccc2200000003
-USER WRITE: addr 0x23, size 8, value 0xcccccc2e00000004
-USER WRITE: addr 0x2b, size 8, value 0xcccccc2000000005
-USER WRITE: addr 0x33, size 8, value 0xcccccc1a00000006
-USER WRITE: addr 0x3b, size 8, value 0xcccccc1000000007
-USER WRITE: addr 0x43, size 8, value 0xcccccc1200000008
+USER WRITE: addr 0x3, size 8, value 0xdddddd0000000000
+USER WRITE: addr 0xb, size 8, value 0xdddddd0a00000001
+USER WRITE: addr 0x13, size 8, value 0xdddddd1800000002
+USER WRITE: addr 0x1b, size 8, value 0xdddddd2200000003
+USER WRITE: addr 0x23, size 8, value 0xdddddd2e00000004
+USER WRITE: addr 0x2b, size 8, value 0xdddddd2000000005
+USER WRITE: addr 0x33, size 8, value 0xdddddd1a00000006
+USER WRITE: addr 0x3b, size 8, value 0xdddddd1000000007
+USER WRITE: addr 0x43, size 8, value 0xdddddd1200000008
sysret
OUT OF FUZZER INPUT DATA - REWINDING
REWIND STATS: 1/sec
REWIND! (trigger_exception=0x10006; cycles=550)

#### TESTCASE 'id:012903,src:012873,op:arith16,pos:30,val:be:+34,+cov'
loaded 68 bytes fuzzdata
[...]
syscall(rax=0x600020000ca, args=[0x3, 0x3, 0x3, 0xea800f00000069, 0x10003, 0x0]); rsp=0x7ffee8bc9da8
USER READ: addr 0x3, size 8, value 0x0000007200000004
USER READ: addr 0xb, size 1, value 0x66
USER READ: addr 0xc, size 1, value 0x00
USER READ: addr 0xd, size 1, value 0x00
USER READ: addr 0xe, size 1, value 0x00
timeout bump
-USER WRITE: addr 0x3, size 8, value 0xcccccc0000000000
-USER WRITE: addr 0xb, size 8, value 0xcccccc0100000000
-USER WRITE: addr 0x13, size 8, value 0xcccccc0200000000
-USER WRITE: addr 0x1b, size 8, value 0xcccccc0300000000
-USER WRITE: addr 0x23, size 8, value 0xcccccc0400000000
-USER WRITE: addr 0x2b, size 8, value 0xcccccc0500000000
-USER WRITE: addr 0x33, size 8, value 0xcccccc0600000000
-USER WRITE: addr 0x3b, size 8, value 0xcccccc0700000000
-USER WRITE: addr 0x43, size 8, value 0xcccccc08000000c8
-USER WRITE: addr 0x4b, size 8, value 0xcccccc09000000c8
-USER WRITE: addr 0x53, size 8, value 0xcccccc0a000000c8
-USER WRITE: addr 0x5b, size 8, value 0xcccccc0b000000c8
-USER WRITE: addr 0x63, size 8, value 0xcccccc0c000000c8
-USER WRITE: addr 0x6b, size 8, value 0xcccccc0d000000c8
-USER WRITE: addr 0x73, size 8, value 0xcccccc0e000000c8
-USER WRITE: addr 0x7b, size 8, value 0xcccccc0f000000c8
-USER WRITE: addr 0x83, size 8, value 0xcccccc10000000c8
-USER WRITE: addr 0x8b, size 8, value 0xcccccc11000000c8
-USER WRITE: addr 0x93, size 8, value 0xcccccc12000000c8
-USER WRITE: addr 0x9b, size 8, value 0xcccccc13000000c8
-USER WRITE: addr 0xa3, size 8, value 0xcccccc14000000c8
-USER WRITE: addr 0xab, size 8, value 0xcccccc15000000c8
-USER WRITE: addr 0xb3, size 8, value 0xcccccc16000000c8
-USER WRITE: addr 0xbb, size 8, value 0xcccccc17000000c8
-USER WRITE: addr 0xc3, size 8, value 0xcccccc1800000000
-USER WRITE: addr 0xcb, size 8, value 0xcccccc1900000000
-USER WRITE: addr 0xd3, size 8, value 0xcccccc1a00000000
-USER WRITE: addr 0xdb, size 8, value 0xcccccc1b00000000
-USER WRITE: addr 0xe3, size 8, value 0xcccccc1c00000000
-USER WRITE: addr 0xeb, size 8, value 0xcccccc1d00000000
-USER WRITE: addr 0xf3, size 8, value 0xcccccc1e00000000
-USER WRITE: addr 0xfb, size 8, value 0xcccccc1f00000000
-USER WRITE: addr 0x103, size 8, value 0xcccccc20000002bc
-USER WRITE: addr 0x10b, size 8, value 0xcccccc21000002bc
-USER WRITE: addr 0x113, size 8, value 0xcccccc22000002bc
-USER WRITE: addr 0x11b, size 8, value 0xcccccc23000002bc
-USER WRITE: addr 0x123, size 8, value 0xcccccc24000002bc
-USER WRITE: addr 0x12b, size 8, value 0xcccccc25000002bc
-USER WRITE: addr 0x133, size 8, value 0xcccccc26000002bc
-USER WRITE: addr 0x13b, size 8, value 0xcccccc27000002bc
-USER WRITE: addr 0x143, size 8, value 0xcccccc28000002bc
-USER WRITE: addr 0x14b, size 8, value 0xcccccc29000002bc
-USER WRITE: addr 0x153, size 8, value 0xcccccc2a000002bc
-USER WRITE: addr 0x15b, size 8, value 0xcccccc2b000002bc
-USER WRITE: addr 0x163, size 8, value 0xcccccc2c000002bc
-USER WRITE: addr 0x16b, size 8, value 0xcccccc2d000002bc
-USER WRITE: addr 0x173, size 8, value 0xcccccc2e000002bc
-USER WRITE: addr 0x17b, size 8, value 0xcccccc2f000002bc
-USER WRITE: addr 0x183, size 8, value 0xcccccc3000000320
-USER WRITE: addr 0x18b, size 8, value 0xcccccc3100000320
-USER WRITE: addr 0x193, size 8, value 0xcccccc3200000320
-USER WRITE: addr 0x19b, size 8, value 0xcccccc3300000320
-USER WRITE: addr 0x1a3, size 8, value 0xcccccc3400000320
-USER WRITE: addr 0x1ab, size 8, value 0xcccccc3500000320
-USER WRITE: addr 0x1b3, size 8, value 0xcccccc3600000320
-USER WRITE: addr 0x1bb, size 8, value 0xcccccc3700000320
-USER WRITE: addr 0x1c3, size 8, value 0xcccccc3800000320
-USER WRITE: addr 0x1cb, size 8, value 0xcccccc3900000320
-USER WRITE: addr 0x1d3, size 8, value 0xcccccc3a00000320
-USER WRITE: addr 0x1db, size 8, value 0xcccccc3b00000320
-USER WRITE: addr 0x1e3, size 8, value 0xcccccc3c00000320
-USER WRITE: addr 0x1eb, size 8, value 0xcccccc3d00000320
-USER WRITE: addr 0x1f3, size 8, value 0xcccccc3e00000320
-USER WRITE: addr 0x1fb, size 8, value 0xcccccc3f00000320
+USER WRITE: addr 0x3, size 8, value 0xdddddd0000000000
+USER WRITE: addr 0xb, size 8, value 0xdddddd0100000000
+USER WRITE: addr 0x13, size 8, value 0xdddddd0200000000
+USER WRITE: addr 0x1b, size 8, value 0xdddddd0300000000
+USER WRITE: addr 0x23, size 8, value 0xdddddd0400000000
+USER WRITE: addr 0x2b, size 8, value 0xdddddd0500000000
+USER WRITE: addr 0x33, size 8, value 0xdddddd0600000000
+USER WRITE: addr 0x3b, size 8, value 0xdddddd0700000000
+USER WRITE: addr 0x43, size 8, value 0xdddddd08000000c8
+USER WRITE: addr 0x4b, size 8, value 0xdddddd09000000c8
+USER WRITE: addr 0x53, size 8, value 0xdddddd0a000000c8
+USER WRITE: addr 0x5b, size 8, value 0xdddddd0b000000c8
+USER WRITE: addr 0x63, size 8, value 0xdddddd0c000000c8
+USER WRITE: addr 0x6b, size 8, value 0xdddddd0d000000c8
+USER WRITE: addr 0x73, size 8, value 0xdddddd0e000000c8
+USER WRITE: addr 0x7b, size 8, value 0xdddddd0f000000c8
+USER WRITE: addr 0x83, size 8, value 0xdddddd10000000c8
+USER WRITE: addr 0x8b, size 8, value 0xdddddd11000000c8
+USER WRITE: addr 0x93, size 8, value 0xdddddd12000000c8
+USER WRITE: addr 0x9b, size 8, value 0xdddddd13000000c8
+USER WRITE: addr 0xa3, size 8, value 0xdddddd14000000c8
+USER WRITE: addr 0xab, size 8, value 0xdddddd15000000c8
+USER WRITE: addr 0xb3, size 8, value 0xdddddd16000000c8
+USER WRITE: addr 0xbb, size 8, value 0xdddddd17000000c8
+USER WRITE: addr 0xc3, size 8, value 0xdddddd1800000000
+USER WRITE: addr 0xcb, size 8, value 0xdddddd1900000000
+USER WRITE: addr 0xd3, size 8, value 0xdddddd1a00000000
+USER WRITE: addr 0xdb, size 8, value 0xdddddd1b00000000
+USER WRITE: addr 0xe3, size 8, value 0xdddddd1c00000000
+USER WRITE: addr 0xeb, size 8, value 0xdddddd1d00000000
+USER WRITE: addr 0xf3, size 8, value 0xdddddd1e00000000
+USER WRITE: addr 0xfb, size 8, value 0xdddddd1f00000000
+USER WRITE: addr 0x103, size 8, value 0xdddddd20000002bc
+USER WRITE: addr 0x10b, size 8, value 0xdddddd21000002bc
+USER WRITE: addr 0x113, size 8, value 0xdddddd22000002bc
+USER WRITE: addr 0x11b, size 8, value 0xdddddd23000002bc
+USER WRITE: addr 0x123, size 8, value 0xdddddd24000002bc
+USER WRITE: addr 0x12b, size 8, value 0xdddddd25000002bc
+USER WRITE: addr 0x133, size 8, value 0xdddddd26000002bc
+USER WRITE: addr 0x13b, size 8, value 0xdddddd27000002bc
+USER WRITE: addr 0x143, size 8, value 0xdddddd28000002bc
+USER WRITE: addr 0x14b, size 8, value 0xdddddd29000002bc
+USER WRITE: addr 0x153, size 8, value 0xdddddd2a000002bc
+USER WRITE: addr 0x15b, size 8, value 0xdddddd2b000002bc
+USER WRITE: addr 0x163, size 8, value 0xdddddd2c000002bc
+USER WRITE: addr 0x16b, size 8, value 0xdddddd2d000002bc
+USER WRITE: addr 0x173, size 8, value 0xdddddd2e000002bc
+USER WRITE: addr 0x17b, size 8, value 0xdddddd2f000002bc
+USER WRITE: addr 0x183, size 8, value 0xdddddd3000000320
+USER WRITE: addr 0x18b, size 8, value 0xdddddd3100000320
+USER WRITE: addr 0x193, size 8, value 0xdddddd3200000320
+USER WRITE: addr 0x19b, size 8, value 0xdddddd3300000320
+USER WRITE: addr 0x1a3, size 8, value 0xdddddd3400000320
+USER WRITE: addr 0x1ab, size 8, value 0xdddddd3500000320
+USER WRITE: addr 0x1b3, size 8, value 0xdddddd3600000320
+USER WRITE: addr 0x1bb, size 8, value 0xdddddd3700000320
+USER WRITE: addr 0x1c3, size 8, value 0xdddddd3800000320
+USER WRITE: addr 0x1cb, size 8, value 0xdddddd3900000320
+USER WRITE: addr 0x1d3, size 8, value 0xdddddd3a00000320
+USER WRITE: addr 0x1db, size 8, value 0xdddddd3b00000320
+USER WRITE: addr 0x1e3, size 8, value 0xdddddd3c00000320
+USER WRITE: addr 0x1eb, size 8, value 0xdddddd3d00000320
+USER WRITE: addr 0x1f3, size 8, value 0xdddddd3e00000320
+USER WRITE: addr 0x1fb, size 8, value 0xdddddd3f00000320
sysret
OUT OF FUZZER INPUT DATA - REWINDING
REWIND! (trigger_exception=0x10006; cycles=32)



Verified on a Macmini7,1 running macOS 10.13 (17A405), Darwin 17.0.0:

$ sysctl -x net.qos.default_netsvctype_to_dscp_map
net.qos.default_netsvctype_to_dscp_map: Format:S Length:72 Dump:0x0000000000000000010000000a00000002000000187f00000300000022ffffff040000002e0000000500000020ffffff060000001affffff07000000100000000800000012000000
$ sysctl -x net.qos.dscp_to_wifi_ac_map
net.qos.dscp_to_wifi_ac_map: Format:S Length:512 Dump:0x0000000000ffffff0000000001000000000000000200000000000000030000000000000004000000000000000500000000000000060000000000000007000000c800000008000000c800000009000000c80000000a000000c80000000b000000c80000000c000000c80000000d000000c80000000e000000c80000000f000000c800000010000000c800000011ffffffc800000012000000c800000013000000c800000014000000c800000015000000c800000016000000c80000001700000000000000180000000000000019000000000000001a000000000000001b000000000000001c000000000000001d000000000000001e000000000000001f000000bc02000020000000bc02000021000000bc02000022000000bc02000023000000bc02000024000000bc02000025000000bc02000026ffffffbc02000027ffffffbc02000028ffffffbc02000029ffffffbc0200002affffffbc0200002bffffffbc0200002cffffffbc0200002dffffffbc0200002e000000bc0200002fffffff20030000300000002003000031ffffff2003000032ffffff2003000033000000200300003400000020030000350000002003000036ffffff2003000037ffffff20030000380000002003000039000000200300003a7f0000200300003bffffff200300003c000000200300003dffffff200300003effffff200300003f000000


This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.



Found by: jannh