Proteas

//
//  PoC.m
//  IOSABugTrigger
//
//  Created by Linus Henze on 2023-04-08.
//  Copyright © 2023 Pinauten GmbH. Some rights reserved.
//

//
// This is a PoC for CVE-2023-28206, triggering an oob memmove in IosaColorManagerMSR8::getHDRStats_gatedContext

Proteas

data source

• https://github.com/Proteas/kalloc-type/blob/main/iOS-v16.0-20A5283p-iPhone14%2C2-kalloc-type-view.json

type count: 194

    size: 168, name: AFKEndpointInterface_DescriptorBase
    size: 168, name: AGXPerfCtrSampler
    size: 168, name: AVE_DRC
    size: 168, name: AppleAOPAudioAmpManagerDevice
    size: 168, name: AppleAOPAudioButtonOutputDevice
    size: 168, name: AppleAOPAudioDevice

Proteas

kernel

• xnu-8020.140.20.0.4~14

My Conclusion

1. kernel heap hardening: tag, type hash
   • kmem_alloc_guard
   • kmem_apply_security_policy
2. codesign, protecting the members with DA Key
   • csfg_get_*

Proteas

Here's a list of mildly interesting things about the C language that I learned mostly by consuming Clang's ASTs. Although surprises are getting sparser, I might continue to update this document over time.

There are many more mildly interesting features of C++, but the language is literally known for being weird, whereas C is usually considered smaller and simpler, so this is (almost) only about C.

1. Combined type and variable/field declaration, inside a struct scope [https://godbolt.org/g/Rh94Go]

struct foo {
   struct bar {
 int x;

Proteas

/usr/libexec/backboardd
/usr/sbin/mediaserverd
/System/Library/Frameworks/WebKit.framework/XPCServices/com.apple.WebKit.GPU.xpc/com.apple.WebKit.GPU
/System/Library/Frameworks/WebKit.framework/XPCServices/com.apple.WebKit.WebContent.xpc/com.apple.WebKit.WebContent
/System/Library/Frameworks/AssetsLibrary.framework/Support/assetsd
/System/Library/PrivateFrameworks/NanoTimeKitCompanion.framework/nanotimekitcompaniond
/System/Library/PrivateFrameworks/NanoTimeKitCompanion.framework/XPCServices/NTKFaceSnapshotService.xpc/NTKFaceSnapshotService
/System/Library/PrivateFrameworks/IMTranscoding.framework/XPCServices/IMTranscoderAgent.xpc/IMTranscoderAgent
/System/Library/PrivateFrameworks/CoreSuggestions.framework/suggestd
/private/var/staged_system_apps/Maps.app/Maps

Proteas

MSC__kernelrpc_mach_vm_allocate_trap
MSC__kernelrpc_mach_vm_purgable_control_trap
MSC__kernelrpc_mach_vm_deallocate_trap
MSC__kernelrpc_mach_vm_protect_trap
MSC__kernelrpc_mach_vm_map_trap
MSC__kernelrpc_mach_port_allocate_trap
MSC__kernelrpc_mach_port_deallocate_trap
MSC__kernelrpc_mach_port_mod_refs_trap
MSC__kernelrpc_mach_port_insert_right_trap
MSC__kernelrpc_mach_port_insert_member_trap

Proteas

SYS_exit
SYS_read
SYS_write
SYS_open
SYS_close
SYS_unlink
SYS_chmod
SYS_chown
SYS_getfsstat
SYS_getuid

Proteas

diff --git a/mac_policy_ops.c b/mac_policy_ops.c
index 798bd29..bb3c425 100644
--- a/mac_policy_ops.c
+++ b/mac_policy_ops.c
@@ -2,10 +2,10 @@ struct mac_policy_ops
 {
   mpo_audit_check_postselect_t *mpo_audit_check_postselect;
   mpo_audit_check_preselect_t *mpo_audit_check_preselect;
-  mpo_bpfdesc_label_associate_t *mpo_bpfdesc_label_associate;
-  mpo_bpfdesc_label_destroy_t *mpo_bpfdesc_label_destroy;

Proteas

iOS-v14.0-18A5301v-WebContent-Unix-Mach-MIG

Syscall-Unix

SYS_exit
SYS_read
SYS_write
SYS_open
SYS_close
SYS_link

Proteas

*** ent-list-17E262-iPhone11,2.json	2020-05-25 11:16:14.000000000 +0800
--- ent-list-17F75-iPhone11,2.json	2020-05-25 11:02:29.000000000 +0800
***************
*** 389,394 ****
--- 389,395 ----
      "com.apple.developer.default-data-protection", 
+     "com.apple.developer.exposure-notification", 
      "com.apple.developer.extension-host.photo-editing", 
***************
*** 820,826 ****