bazad/iofirewirefamily-overflowCVE-2016-7608: Buffer overflow in IOFireWireFamily.
IOFireWireFamily-overflow is a proof-of-concept exploit for CVE-2016-7608, a buffer overflow in
IOFireWireUserClient that was fixed in macOS Sierra 10.12.2. This vulnerability can be
triggered to cause denial of service or possibly arbitrary code execution on devices with a
FireWire port.
The AppleFWOHCI::updateROM method does not check the length of an OSData argument before bcopying
its contents into a fixed-size memory region allocated using AppleFWOHCI_IOMemoryBlock32::create.
The exploit can be triggered using an instance of IOFireWireUserClient. Calling the method
localConfigDirectory_Create yields a handle to an IOLocalConfigDirectory. Arbitrary data can be
added to this directory object using the method, which does
not restrict the size of the data beyond the limits of the 32-bit parameter. Finally, the
exploit can be triggered by calling , which eventually calls
. creates an object representing the compiled
ROM, including the user-controlled data added earlier. It then passes the object to
, which copies the data into the memory region pointed to by
. This is a 4096-byte memory region allocated in using
. If more than 4096 bytes are passed to
, then the write will overflow this allocation onto the
subsequent pages.
localConfigDirectory_addEntry_BuffersizelocalConfigDirectory_PublishIOFireWireController::UpdateROMUpdateROMOSDataOSDataAppleFWOHCI::updateROMfpNextConfigROMAppleFWOHCI::setupAsyncAppleFWOHCI_IOMemoryBlock32::createlocalConfigDirectory_addEntry_BufferIn practice, the page after the overflowed buffer is usually unmapped, causing a kernel panic on overflow.
The IOFireWireFamily-overflow code is released into the public domain. As a courtesy I ask that if you reference or use any of this code you attribute it to me.