8 ms·

OS X 10.11 buffer overflow with deep filesystem hierarchy

109 points by ivank 11y ago

zwp 11y ago
Since this doesn't cause a system panic... multiple userland utilities have MAXPATHLEN problems? Is this reproducible with longer filenames and less depth? (If not: what cares about depth?)
reilly3000 11y ago
So in theory if you wanted to take down a web server that allows for creating files in a directory structure you just have to nest less than 1k of them to start wreaking havoc? Yikes if so.
- Alphasite_ 11y ago
  Its not really a big issue when you consider that no one does any serious web hosting on OSX server. Maybe if you relied on it for profiles?
  - tajen 11y ago
    Not very related, but it reminds me that there are a lot of people who rack Mac Pros in data centers. Not Mac Mini. Mac Pros. Yes, the cylinder one. I guess it's mostly for graphics and rendering capabilities or when testing requires the original machines. People come up with all sorts of tricks because it is very inefficient - like vents [1] - or this other company who 3D-printed pieces to keep the Macbook Pros open at 7mm (=0,05 banana) [2]. [1] I especially liked this blog: http://photos.imgix.com/racking-mac-pros http://photos.imgix.com/racking-mac-pros [2] https://simbimbo.wordpress.com/2015/07/24/well-im-at-it-again-this-time-with-macbook-pros/ https://simbimbo.wordpress.com/2015/07/24/well-im-at-it-agai...
- huuu 11y ago
  What about sending someone a zip with such a directory structure?
  - dogma1138 11y ago
    That's possible many AV products do not look into archives past a certain limit sending out a zip file with say a PDF and a hidden payload in a sub directory beyond the lookup depth of the AV software used to be a common way to achieve AV avoidance. commercial ZIP software however usually limits the maximum depth and file path name to the lowest common denominator which is 250 chars for compatibility with Windows, some software will have a "unix" mode in which the max limit is increased to 1024.
- trengrj 11y ago
  An OS X web server... As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code http://meta.ath0.com/2012/02/05/apples-great-gpl-purge/ http://meta.ath0.com/2012/02/05/apples-great-gpl-purge/. This results in their userspace code being out of date (i.e. they still use bash version 3.2) and having bugs like these.
  - the_mitsuhiko 11y ago
    > As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code They do not refuse, they cannot include it from a legal point of view.
    - hedwall 11y ago
      What is the difference between GPL2 and GPL3 that makes this impossible from a legal POV?
      - Someone 11y ago
        I don't think anybody knows whether there is a real difference, but the increased strictness of GPL3 such as its anti-TIVOization (https://en.m.wikipedia.org/wiki/Tivoization https://en.m.wikipedia.org/wiki/Tivoization) clauses certainly make a lot of lawyers concerned. Where exactly the border lies between and not linking is a grey area, legally, that hasn't become clearer with GPL3. It wouldn't surprise me to see bash go from the standard install, too. Apple is slowly removing all GPL code from its OS.
        autoreleasepool 11y ago
        I hope they make ZSH the standard shell. It's similar enough to bash to not disrupt most workflows and Apple has been able to update it due to its permissive license. I use ZSH as my main shell on OS X. I find it superior to bash in almost every way (especially with oh-my-zsh) except in ubiquity. Even so, I have no problem using bash if that's all that's available, the two shells are fairly compatible.
devit 11y ago
This is because OSX uses a feature-limited (and apparently completely broken given this report...) BSD-derived userspace instead of the GNU software used with Linux, which are usually specifically designed to not have fixed limits of any kind.
- daenney 11y ago
  That's because, license wise, they can't include GPL 3 licensed code, aka the GNU user space. Also, this bug does not prove that the whole user space is completely broken. Many people use it daily without ever hitting these bugs. If you go looking for issues, you'll find them, just as you'll find them on Linux but in different places. Not to say this doesn't suck and we shouldn't fix them, but it's hardly proof of anything.
  - devit 11y ago
    Where "can't" means "they don't want to because they want to reserve themselves the ability to screw their users by shipping devices with OSX or derivatives installed where the user cannot change the software, which the GPLv3 is specifically designed to prevent". Considering handling paths is one of the most fundamental functions of the Unix tools and C library, having buffer overflows there is quite damning.
    - daenney 11y ago
      Regardless of your personal dislike of the vendor, there have been plenty of buffer overflows and other bugs in coreutils/fileutils. The Mac/BSD user space is by no means an exception.
      - lmm 11y ago
        Which is a real indictment of C, when programs this simple have bugs this severe.
- misterdata 11y ago
  So I assume this means the other BSDs (e.g. FreeBSD) exhibit the same bug?
userbinator 11y ago
The article references http://www.opensource.apple.com/source/Libc/Libc-1044.40.1/gen/fts.c http://www.opensource.apple.com/source/Libc/Libc-1044.40.1/g... but there's nothing that particularly stands out as being the bug at a quick glance and it is designed to handle arbitrarily deep hierarchies; nonetheless this looks like an off-by-one to me (in fts_alloc): len = sizeof(FTSENT) + namelen; if (!ISSET(FTS_NOSTAT)) len += sizeof(struct stat) + ALIGNBYTES; if ((p = malloc(len)) == NULL) return (NULL); /* Copy the name plus the trailing NULL. */ memmove(p->fts_name, name, namelen + 1); It's a pretty minor bug, since I'd bet the chances of it causing a major exploitable vulnerability are quite low. A theoretical attacker can only control somewhat coarsely where a single byte with the value 0 can be written, and this is in userspace. Most of the time it probably lands in unused padding, and otherwise in an invalid address which causes a segfault.
- deleted 11y ago
  [deleted]
- pixelbeat 11y ago
  There have been a couple of recent changes to the latest GNU version of that related to flexible array members: https://github.com/coreutils/gnulib/blame/master/lib/fts.c#L1901 https://github.com/coreutils/gnulib/blame/master/lib/fts.c#L... https://github.com/coreutils/gnulib/commit/49078a78 https://github.com/coreutils/gnulib/commit/49078a78
  - just_curioussss 11y ago
    This part is also suspicious: p->fts_statp = (struct stat )ALIGN(p->fts_name + namelen + 2);* Unless ALIGN aligns the pointer towards the lower address( which would be weird ), that +2 might get out of bounds depending on how many bytes is ALIGNBYTES. Please correct me if I'm wrong. Edit: This is the header that defines the struct FTSENT: https://opensource.apple.com/source/Libc/Libc-1044.40.1/include/fts.h https://opensource.apple.com/source/Libc/Libc-1044.40.1/incl...
    - 11y ago
thesorrow 11y ago
Seems like there's a lot more vuln with OSX in the last few releases. I'm still using OSX for basic stuff like browsing but I rely on a linux VM to do the serious stuff. I know that my vm can be compromised if the host system is vulnerable but I feel safer.
- mikeokner 11y ago
  I ended up just installing Arch on my MacBook. Runs surprisingly well. I'm able to share my home dir since its on a second partition, so I didn't really have to start from scratch. I haven't booted into OS X in weeks.
- acdha 11y ago
  Have you considered how much of that might be due to Apple's takeover of the consumer space? There were fewer people looking for exploits and even fewer reporters covering them before they became the OS of choice for hundreds of millions of people. If you believe Linux is that much better, well, you really ought to follow your distribution's security announcement list. Nobody in the general computing space has a track record which entitles them to cast aspersions at the competition.
dhess 11y ago
I reported this bug to Apple back in September, but as we know, filing Radars is practically pointless and as of today it still hasn't even been read. https://openradar.appspot.com/22671534 https://openradar.appspot.com/22671534

109 points by ivank 11y ago

zwp 11y ago

Since this doesn't cause a system panic... multiple userland utilities have MAXPATHLEN problems? Is this reproducible with longer filenames and less depth? (If not: what cares about depth?)

reilly3000 11y ago

So in theory if you wanted to take down a web server that allows for creating files in a directory structure you just have to nest less than 1k of them to start wreaking havoc? Yikes if so.

Alphasite_ 11y ago
Its not really a big issue when you consider that no one does any serious web hosting on OSX server. Maybe if you relied on it for profiles?
- tajen 11y ago
  Not very related, but it reminds me that there are a lot of people who rack Mac Pros in data centers. Not Mac Mini. Mac Pros. Yes, the cylinder one. I guess it's mostly for graphics and rendering capabilities or when testing requires the original machines. People come up with all sorts of tricks because it is very inefficient - like vents [1] - or this other company who 3D-printed pieces to keep the Macbook Pros open at 7mm (=0,05 banana) [2]. [1] I especially liked this blog: http://photos.imgix.com/racking-mac-pros http://photos.imgix.com/racking-mac-pros [2] https://simbimbo.wordpress.com/2015/07/24/well-im-at-it-again-this-time-with-macbook-pros/ https://simbimbo.wordpress.com/2015/07/24/well-im-at-it-agai...
huuu 11y ago
What about sending someone a zip with such a directory structure?
- dogma1138 11y ago
  That's possible many AV products do not look into archives past a certain limit sending out a zip file with say a PDF and a hidden payload in a sub directory beyond the lookup depth of the AV software used to be a common way to achieve AV avoidance. commercial ZIP software however usually limits the maximum depth and file path name to the lowest common denominator which is 250 chars for compatibility with Windows, some software will have a "unix" mode in which the max limit is increased to 1024.
trengrj 11y ago
An OS X web server... As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code http://meta.ath0.com/2012/02/05/apples-great-gpl-purge/ http://meta.ath0.com/2012/02/05/apples-great-gpl-purge/. This results in their userspace code being out of date (i.e. they still use bash version 3.2) and having bugs like these.
- the_mitsuhiko 11y ago
  > As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code They do not refuse, they cannot include it from a legal point of view.
  - hedwall 11y ago
    What is the difference between GPL2 and GPL3 that makes this impossible from a legal POV?
    - Someone 11y ago
      I don't think anybody knows whether there is a real difference, but the increased strictness of GPL3 such as its anti-TIVOization (https://en.m.wikipedia.org/wiki/Tivoization https://en.m.wikipedia.org/wiki/Tivoization) clauses certainly make a lot of lawyers concerned. Where exactly the border lies between and not linking is a grey area, legally, that hasn't become clearer with GPL3. It wouldn't surprise me to see bash go from the standard install, too. Apple is slowly removing all GPL code from its OS.
      - autoreleasepool 11y ago
        I hope they make ZSH the standard shell. It's similar enough to bash to not disrupt most workflows and Apple has been able to update it due to its permissive license. I use ZSH as my main shell on OS X. I find it superior to bash in almost every way (especially with oh-my-zsh) except in ubiquity. Even so, I have no problem using bash if that's all that's available, the two shells are fairly compatible.

devit 11y ago

This is because OSX uses a feature-limited (and apparently completely broken given this report...) BSD-derived userspace instead of the GNU software used with Linux, which are usually specifically designed to not have fixed limits of any kind.

daenney 11y ago
That's because, license wise, they can't include GPL 3 licensed code, aka the GNU user space. Also, this bug does not prove that the whole user space is completely broken. Many people use it daily without ever hitting these bugs. If you go looking for issues, you'll find them, just as you'll find them on Linux but in different places. Not to say this doesn't suck and we shouldn't fix them, but it's hardly proof of anything.
- devit 11y ago
  Where "can't" means "they don't want to because they want to reserve themselves the ability to screw their users by shipping devices with OSX or derivatives installed where the user cannot change the software, which the GPLv3 is specifically designed to prevent". Considering handling paths is one of the most fundamental functions of the Unix tools and C library, having buffer overflows there is quite damning.
  - daenney 11y ago
    Regardless of your personal dislike of the vendor, there have been plenty of buffer overflows and other bugs in coreutils/fileutils. The Mac/BSD user space is by no means an exception.
    - lmm 11y ago
      Which is a real indictment of C, when programs this simple have bugs this severe.
misterdata 11y ago
So I assume this means the other BSDs (e.g. FreeBSD) exhibit the same bug?

userbinator 11y ago

The article references http://www.opensource.apple.com/source/Libc/Libc-1044.40.1/gen/fts.c http://www.opensource.apple.com/source/Libc/Libc-1044.40.1/g... but there's nothing that particularly stands out as being the bug at a quick glance and it is designed to handle arbitrarily deep hierarchies; nonetheless this looks like an off-by-one to me (in fts_alloc): len = sizeof(FTSENT) + namelen; if (!ISSET(FTS_NOSTAT)) len += sizeof(struct stat) + ALIGNBYTES; if ((p = malloc(len)) == NULL) return (NULL); /* Copy the name plus the trailing NULL. */ memmove(p->fts_name, name, namelen + 1); It's a pretty minor bug, since I'd bet the chances of it causing a major exploitable vulnerability are quite low. A theoretical attacker can only control somewhat coarsely where a single byte with the value 0 can be written, and this is in userspace. Most of the time it probably lands in unused padding, and otherwise in an invalid address which causes a segfault.

deleted 11y ago
[deleted]
pixelbeat 11y ago
There have been a couple of recent changes to the latest GNU version of that related to flexible array members: https://github.com/coreutils/gnulib/blame/master/lib/fts.c#L1901 https://github.com/coreutils/gnulib/blame/master/lib/fts.c#L... https://github.com/coreutils/gnulib/commit/49078a78 https://github.com/coreutils/gnulib/commit/49078a78
- just_curioussss 11y ago
  This part is also suspicious: p->fts_statp = (struct stat )ALIGN(p->fts_name + namelen + 2);* Unless ALIGN aligns the pointer towards the lower address( which would be weird ), that +2 might get out of bounds depending on how many bytes is ALIGNBYTES. Please correct me if I'm wrong. Edit: This is the header that defines the struct FTSENT: https://opensource.apple.com/source/Libc/Libc-1044.40.1/include/fts.h https://opensource.apple.com/source/Libc/Libc-1044.40.1/incl...
  - 11y ago

thesorrow 11y ago

Seems like there's a lot more vuln with OSX in the last few releases. I'm still using OSX for basic stuff like browsing but I rely on a linux VM to do the serious stuff. I know that my vm can be compromised if the host system is vulnerable but I feel safer.

mikeokner 11y ago
I ended up just installing Arch on my MacBook. Runs surprisingly well. I'm able to share my home dir since its on a second partition, so I didn't really have to start from scratch. I haven't booted into OS X in weeks.
acdha 11y ago
Have you considered how much of that might be due to Apple's takeover of the consumer space? There were fewer people looking for exploits and even fewer reporters covering them before they became the OS of choice for hundreds of millions of people. If you believe Linux is that much better, well, you really ought to follow your distribution's security announcement list. Nobody in the general computing space has a track record which entitles them to cast aspersions at the competition.

dhess 11y ago

I reported this bug to Apple back in September, but as we know, filing Radars is practically pointless and as of today it still hasn't even been read. https://openradar.appspot.com/22671534 https://openradar.appspot.com/22671534