7 ms·

XNU kernel heap overflow due to bad bounds checking in MPTCP

62 points by QUFB 8y ago

tsomctl 8y ago
> Note that the MPTCP code does seem to be quite buggy > ...but is indicative of untested code That's not encouraging.
- favorited 8y ago
  I'm definitely guilty of not unit testing my error paths robustly. Line-by-line code coverage reports showed pretty consistent gaps, especially when operations become no-ops by returning early in case of certain errors. Kind of surprising that other kinds of testing didn't reveal that bad log line, since it will always KP...
  - candiodari 8y ago
    Unit tests are just example-based tests. They cannot test the code does nothing wrong in any case, they just test that in 1 specific case, it works. Only proof-based methods can prove code works under every case. If you're interested, see Coq [1] (including the first guaranteed-correct C compiler) or Isabelle. [1] https://en.wikipedia.org/wiki/Coq https://en.wikipedia.org/wiki/Coq
saagarjha 8y ago
For those unaware, this is not the bug most jailbreakers will use for iOS 11.3.1, because I believe it requires a developer certificate. There is another, hard to exploit bug that does not.
- pedro84 8y ago
  https://twitter.com/i41nbeer/status/1004130737174515712 https://twitter.com/i41nbeer/status/1004130737174515712 """ The trigger is here: https://bugs.chromium.org/p/project-zero/issues/detail?id=1564 https://bugs.chromium.org/p/project-zero/issues/detail?id=15... … If you're in to iOS exploit dev take a go at it and blog about it! I'll publish what I have soon, hopefully this week. """
  - exikyut 8y ago
    Wow, the thread seems to have attracted a bunch of people that think all that needs to happen is for someone to sneeze the right way on the exploit and it'll promptly turn into a perfectly-polished jailbreak app. Kind of depressing :(
phs318u 8y ago
FYI this was fixed in both macOS and iOS last updates: https://bugs.chromium.org/p/project-zero/issues/detail?id=1558#c2 https://bugs.chromium.org/p/project-zero/issues/detail?id=15...
WalterBright 8y ago
I don't see how C will ever be free of buffer overflow bugs without language changes. Probably the simplest and most effective would be to not have arrays decay to pointers when passing to a function. https://www.digitalmars.com/articles/b44.html https://www.digitalmars.com/articles/b44.html
- baybal2 8y ago
  That will not be enough
  - WalterBright 8y ago
    D does allow arrays to be passed as function arguments, and I can vouch for how effective it is at eliminating a huge swath of buffer overflows. https://dlang.org/spec/arrays.html#dynamic-arrays https://dlang.org/spec/arrays.html#dynamic-arrays
    - blub 8y ago
      But they key safety feature is bounds checking, not just preventing the decay to pointer.
      - WalterBright 8y ago
        Once you have the array length and pointer, the compiler (as the D compiler does) inserts the array bounds check.
        blub 8y ago
        Indeed, however if you will try to convince a group of C programmers that arrays shouldn't decay to pointers you will get a different reaction compared to trying to convince them that all array accesses should be bounds checked. I would lead with the stronger demand, because that's what would IMO trigger the more interesting discussion.
axilmar 8y ago
This would be caughtable at compile time if the C programming language supported unions in a better way than it currently does. Ada, for example, has discriminants, which allows binding of a specific view of a byte buffer to a specific constant. There are also other solutions, for example making values to be types.

62 points by QUFB 8y ago

tsomctl 8y ago

> Note that the MPTCP code does seem to be quite buggy > ...but is indicative of untested code That's not encouraging.

favorited 8y ago
I'm definitely guilty of not unit testing my error paths robustly. Line-by-line code coverage reports showed pretty consistent gaps, especially when operations become no-ops by returning early in case of certain errors. Kind of surprising that other kinds of testing didn't reveal that bad log line, since it will always KP...
- candiodari 8y ago
  Unit tests are just example-based tests. They cannot test the code does nothing wrong in any case, they just test that in 1 specific case, it works. Only proof-based methods can prove code works under every case. If you're interested, see Coq [1] (including the first guaranteed-correct C compiler) or Isabelle. [1] https://en.wikipedia.org/wiki/Coq https://en.wikipedia.org/wiki/Coq

saagarjha 8y ago

For those unaware, this is not the bug most jailbreakers will use for iOS 11.3.1, because I believe it requires a developer certificate. There is another, hard to exploit bug that does not.

pedro84 8y ago
https://twitter.com/i41nbeer/status/1004130737174515712 https://twitter.com/i41nbeer/status/1004130737174515712 """ The trigger is here: https://bugs.chromium.org/p/project-zero/issues/detail?id=1564 https://bugs.chromium.org/p/project-zero/issues/detail?id=15... … If you're in to iOS exploit dev take a go at it and blog about it! I'll publish what I have soon, hopefully this week. """
- exikyut 8y ago
  Wow, the thread seems to have attracted a bunch of people that think all that needs to happen is for someone to sneeze the right way on the exploit and it'll promptly turn into a perfectly-polished jailbreak app. Kind of depressing :(

phs318u 8y ago

FYI this was fixed in both macOS and iOS last updates: https://bugs.chromium.org/p/project-zero/issues/detail?id=1558#c2 https://bugs.chromium.org/p/project-zero/issues/detail?id=15...

WalterBright 8y ago

I don't see how C will ever be free of buffer overflow bugs without language changes. Probably the simplest and most effective would be to not have arrays decay to pointers when passing to a function. https://www.digitalmars.com/articles/b44.html https://www.digitalmars.com/articles/b44.html

baybal2 8y ago
That will not be enough
- WalterBright 8y ago
  D does allow arrays to be passed as function arguments, and I can vouch for how effective it is at eliminating a huge swath of buffer overflows. https://dlang.org/spec/arrays.html#dynamic-arrays https://dlang.org/spec/arrays.html#dynamic-arrays
  - blub 8y ago
    But they key safety feature is bounds checking, not just preventing the decay to pointer.
    - WalterBright 8y ago
      Once you have the array length and pointer, the compiler (as the D compiler does) inserts the array bounds check.
      - blub 8y ago
        Indeed, however if you will try to convince a group of C programmers that arrays shouldn't decay to pointers you will get a different reaction compared to trying to convince them that all array accesses should be bounds checked. I would lead with the stronger demand, because that's what would IMO trigger the more interesting discussion.

axilmar 8y ago

This would be caughtable at compile time if the C programming language supported unions in a better way than it currently does. Ada, for example, has discriminants, which allows binding of a specific view of a byte buffer to a specific constant. There are also other solutions, for example making values to be types.