44 lines
2.4 KiB
Swift
44 lines
2.4 KiB
Swift
// kern.ipc · XNU · ipc_port.c 请求表消费方 · CVE-2026-112507 / 112476
|
|
// 原语: UAF · 内核 · tier 2
|
|
// Primitive: use-after-free · kernel · tier 2
|
|
//
|
|
// [zh] ipc_port 请求表索引竞态
|
|
// 27.2 为每个消费 per-space 端口请求表索引的函数补入 cmp/b.hi 与 NULL 陷阱（ipc_port.c:21/24/34/38/40/41）。27.0 的 free
|
|
// 路径计算了边界却丢弃结果，仍以未检查的基址执行读改写；mark 路径则完全没有边界计算。索引取自 space 中保存的请求表下标，故缺陷形状为「表增长或拆除」与「通知注册或消息发送」并发下的陈旧索引。
|
|
//
|
|
// [en] ipc_port request table index race
|
|
// iOS 27.2 adds cmp/b.hi and NULL traps to every function that consumes a per-space port request
|
|
// table index (ipc_port.c:21/24/34/38/40/41). On 27.0 the free path computes the bounds and discards
|
|
// the result, still performing the read-modify-write through the unchecked base; the mark path has
|
|
// no bounds computation at all. The index comes from the space's saved request-table slot, so the
|
|
// defect shape is a stale index under concurrency between table growth or teardown and notification
|
|
// registration or message send.
|
|
// ── 判别 / oracle ──
|
|
// 该路径上无 entitlement 门槛的入口为 mach_msg 与端口通知注册。本模块以 8 线程运行 6 秒，统计内核返回码分布 —— 任何非 KERN_SUCCESS 的出现频次变化都是索引越界的候选信号。
|
|
|
|
import Foundation
|
|
|
|
// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
|
|
enum B {
|
|
static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
|
|
static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
|
|
static func be32(_ v: UInt32) -> [UInt8] {
|
|
[UInt8(v >> 24 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 8 & 0xff), UInt8(v & 0xff)]
|
|
}
|
|
static func le32(_ v: UInt32) -> [UInt8] {
|
|
[UInt8(v & 0xff), UInt8(v >> 8 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 24 & 0xff)]
|
|
}
|
|
static func be64(_ v: UInt64) -> [UInt8] {
|
|
(0..<8).map { UInt8((v >> (56 - UInt64($0) * 8)) & 0xff) }
|
|
}
|
|
static func le64(_ v: UInt64) -> [UInt8] {
|
|
(0..<8).map { UInt8((v >> (UInt64($0) * 8)) & 0xff) }
|
|
}
|
|
static func both16(_ v: UInt16) -> [UInt8] { le16(v) + be16(v) }
|
|
static func both32(_ v: UInt32) -> [UInt8] { le32(v) + be32(v) }
|
|
static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
|
|
}
|
|
|
|
|
|
|