Ian Beer released his proof-of-concept for CVE-2022-46689 (MacDirtyCow):
bugs.chromium.org/p/project-zero…
His exploit accomplishes two things I didn't know was possible:
- writing the last byte in a 16k page
- take over system daemons
bugs.chromium.org/p/project-zero…
His exploit accomplishes two things I didn't know was possible:
- writing the last byte in a 16k page
- take over system daemons
https://twitter.com/ProjectZeroBugs/status/1614023688088866817
Both of Ian Beer's solutions were clever:
- The bug only happens when the read/write addresses are unaligned.
I can't move the write address to the last byte because it would become aligned.
Ian Beer's solution: never move the write address; move the READ address instead
- The bug only happens when the read/write addresses are unaligned.
I can't move the write address to the last byte because it would become aligned.
Ian Beer's solution: never move the write address; move the READ address instead
- Code signing prevents overwriting an executable's code
Ian Beer's solution: overwrite an executable's LINKEDIT data instead
This is why Ian Beer is a 大神 and I'm a script kiddie: he not only found the bug but built novel ways to exploit it; I couldn't even adapt existing code.
Ian Beer's solution: overwrite an executable's LINKEDIT data instead
This is why Ian Beer is a 大神 and I'm a script kiddie: he not only found the bug but built novel ways to exploit it; I couldn't even adapt existing code.
Ian's code should make MacDirtyCow apps more powerful. They're no longer restricted to writing at most 16KB: they can write whatever they want, without special padding tricks.
Unfortunately, Ian Beer's proof-of-concept doesn't do kernel read/write, so I doubt this would lead to a full jailbreak.
Ian Beer is trying to exploit "amfid or trustd", which may give apps more power but probably no tweaks, like TrollStore or Ian Beer's previous triple_fetch.
Ian Beer is trying to exploit "amfid or trustd", which may give apps more power but probably no tweaks, like TrollStore or Ian Beer's previous triple_fetch.
For other variant (bugs.chromium.org/p/project-zero…):
- someone copies memory
- you change memory
- their copy magically changes too
@Muirey03 notes (infosec.exchange/@Muirey03/1096…) in theory this can exploit kernel (keenlab.tencent.com/en/2017/01/09/…). In practice I doubt you can win two race conditions.
- someone copies memory
- you change memory
- their copy magically changes too
@Muirey03 notes (infosec.exchange/@Muirey03/1096…) in theory this can exploit kernel (keenlab.tencent.com/en/2017/01/09/…). In practice I doubt you can win two race conditions.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
