Slashdot Mirror
The Story of a Simple and Dangerous OS X Kernel Bug
RazvanM writes "At the beginning of this month the Mac OS X 10.5.8 closed a kernel vulnerability that lasted more than 4 years, covering all the 10.4 and (almost all) 10.5 Mac OS X releases. This article presents some twitter-size programs that trigger the bug. The mechanics are so simple that can be easily explained to anybody possessing some minimal knowledge about how operating systems works. Beside being a good educational example this is also a scary proof that very mature code can still be vulnerable in rather unsophisticated ways."
"Beside being a good educational example this is also a scary proof that very mature code can still be vulnerable in rather unsophisticated ways."
Since when did the age of code become a metric for evaluating its trustworthiness? Code should only be trusted after undergoing in-depth analysis by people with training and experience in information security. Code should also be written with security in mind from the beginning. The story of this kernel bug is simple and goes like this: "I was in a hurry."
#fuckbeta #iamslashdot #dicemustdie
I call fake. It's OS X! It's bullet proof! Steve Jobs would not let this happen! Macs are immune to crashes! Et cetera!
622677120
Sadly I couldn't get my Mac OS X 10.3.9 (PowerPC) machine to panic with the C code.
Alright, I read TFA. I read the earlier slashdot article. I even googled around a little bit. What I find is, an obscure little bug, if exploited locally, enables a user to crash his machine. What I don't find is an exploit that makes use of this bug.
Am I missing something?
I suppose that I could accomplish something similar on my current Ubuntu installation. If I thought it made a difference, I could install a few other flavors of Linux and try doing something like that. But, why?
MS astroturfer's posts above are noted. And, I also note that MS bugs are routinely exploited, locally and remotely. The unwarranted superiority complex looks pretty pathetic, doesn't it?
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
I'm sorry, but what has MacOSX to do with mature code? Code is mature when it has lasted for _decades_ and no significant bug has been found. MacOSX is just your average kernel. OK, there are _much_ worse around, but that doesn't make OSX any better.
What _really_ is a shame that it took them 4 years to fix it.
What are you, a Linux kernel dev? ;)
The bug lets you write arbitrary, user-controlled bytes into kernel space. The first thing that comes to mind is that you could change the current process' priv structure in memory. Now you're root. Or why not use it to hook syscalls, or do really whatever you want? You're in ring0, go nuts.
It's far more than just a DoS.
...no significant bug has been found, but the code has regularly been reviewed.
Despite its relative obviousness, it took me a bit of reading there to figure out what the cause of the bug was, since I was rusty on my Unix system calls, so here's a short summary.
ioctl(2) is essentially a way of specifying system calls for drivers without actually making a system call API, so drivers can register their own calls in a more decentralized way. A call to ioctl(fd, cmd, args, ...) on a special/device file 'fd' gets routed to the driver that owns 'fd', which handles the command. The arguments might be values, or might be pointers to locations in which to return data.
fcntl(2) provides a way to perform operations on open (normal) files, like locking/unlocking them. It has the same parameters as ioctl(), except that there's always a single integer argument.
One way of implementing fcntl is essentially like ioctl -- find who owns the fd, and pass the cmd along to the relevant driver. But, Apple's code did this even for the operations on special devices normally manipulated via ioctl, so you could basically do an ioctl via fcntl. But, this bypasses some of the arg-checking that ioctl does, since fcntl always has one integer argument. So an easy exploit arises: call an ioctl that normally takes one pointer argument to assign something to. ioctl would normally check that the pointer is valid (something the caller is allowed to write to) before writing to it in kernel mode. But you can pass in any memory location at all as an integer via fcntl's argument. Voila, you get data written to arbitrary locations in memory. As an added bonus, some calls let you manipulate what data gets written--- the example exploit uses a "get terminal size" ioctl, so you can vary what gets written by changing your terminal size.
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
So then do so in the summary!
Swedish plasma phys. PhD student; MSc EE; knows maths, programming, electronics; finance interest; seeks opportunities
This article presents some twitter-size programs that trigger the bug.
Ok, I get libraries of congress and olympic-sized swimming pools, but twitter is a new one. Is it used for measuring how long a program is or how pointless it is?
Negative moral value of force outweighs the positive value of good intentions.
So this means we can take those idiotic commercials off the air, right?
When there's as much malware for OS X as there is for Windows, sure.
Okay, I'll make it easy. When there is a tenth as much malware for OS X as there is for Windows, sure.
Hmmm, this isn't working. When there's a hundredth as much ... um, no, that doesn't work either.
A thousandth -- no, damn.
You get the idea. Or maybe you don't.
The correlation between ignorance of statistics and using "correlation is not causation" as an argument is close to 1.
The author might be correct about bug exist. But he is totally lost about operating systems and kernels.
Calls Darwin as the kernel and Mac OSX as OS. Can someone explain then what is the Mach microkernel on the XNU?
Darwin is OS development version. XNU + Apples own compililation tools and configurations. The XNU is the OS of the Mac OS X. It is the OS what is microkernel-based. (Marketed as so called "hybrid kernel").
The XNU OS microkernel is the Mach. The XNU is not kernel, it is the OS. Darwin is not the kernel, it is the XNU OS Apples compiliment tool.
When author talked about kernel, I really tought "here is wiseman" but then he started talking about Darwin as kernel, what would be the Mach in the Darwin (XNU).
http://www.google.nl/search?q=malware+mac says it all. Now get those ads off the air.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Oh look, I think it's trying to communicate, perhaps we can find a translator. Does anyone speak yiddiotish?
Even after the recent security update on Tiger, I still get a kernel panic with the Python code supplied in TFA:
import termios, fcntl
fcntl.fcntl(0, termios.TIOCGWINSZ)
Yeah, I'm planning to upgrade to Snow Leopard soon, after having skipped Leopard. But has Tiger already been abandoned to this extent?
Just buy a PC already.
Macs have a history of having far less vulnerabilities than Windows.
From IBM research: IBM Internet Security Systems X-Force® 2008 Trend & Risk Report
Look under "most vulnerable operating system". Yes, right at the top, for several years going sits OS X. It actually consistently experiences 3 times the number of vulnerabilities compared to Vista.
You can also do some secunia digging yourself. It shows the same tendency even in the raw data.
OS X may be less exploited but it has far more vulnerabilities. On top of that OS X lacks many of the anti-exploit mechanisms found in both common Linux distros and in Windows Vista.
Vulnerabilities does not have much to do with exploits. A single vulnerability may leads to several independant exploits. Many vulnerabilities will pass unexploited. The difference is incentive. And if pwn2own has showed us anything it certainly confirms this. Macs have consistently been the first to fall, literally within seconds.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
This article presents some twitter-size programs that trigger the bug.
Out of interest, what's the justification for linking to the article on "programs that trigger the bug" and not in the blindingly obvious place ("This article")?
I ask because it seems to be in-line with some kind of brain-dead in-house Slashdot linking style, and I'm curious to know the reasoning behind it.
And yet, I never saw any instructions for opening the Wal-Mart special RandomBrand of padlock.
Those locks can be opened by sneezing. Only the person who buys them would need instructions.
mature code ? MacOS ? give me a break. it's not mature with respect to security, it's always features, features, features.
No, it doesn't "say it all".
I can use Google to search for alien abduction, doesn't mean it's some sort of widespread occurrence.
or lack thereof:
"The mechanics are so simple that can be easily explained to anybody possessing some minimal knowledge about how operating systems works."
"...so simple that it can be easily..."
The choice of "some minimal" is a bit questionable too. "some" or "minimal" alone would have been sufficient to convey the meaning. Together, it sounds almost redundant.
"Beside being a good educational example this is also a scary proof that very mature code can still be vulnerable in rather unsophisticated ways."
"Beside" means "next to". "Besides" means "other than".
Not that it really matters. The mainstream news sites can't seem to compose articulate sentences either. Grammar has really gone to crap and it really bugs me that English based news providers can't be bothered to produce fluent English stories.
It looks like there is no patch for 10.4.
That sucks.
" Kernel
CVE-ID: CVE-2009-1235
Available for: Mac OS X v10.5 through v10.5.7, Mac OS X Server v10.5 through v10.5.7
Impact: A local user may obtain system privileges
Description: An implementation issue exists in the kernel's handling of fcntl system calls. A local user may overwrite kernel memory and execute arbitrary code with system privileges. This update addresses the issue through improved handling of fcntl system calls. Credit to Razvan Musaloiu-E. of Johns Hopkins University, HiNRG for reporting this issue."
It seems to me that is the distinction that should be made in this side argument over semantics. I would think "mature" would be more applicable to code that has been around for a "while" without modifications for purpose (for adding function) versus modifications to enhance robustness (for fixing incorrect function/crashing and security exposures). The need to fix security exposures could be driven by new exploits of quite "mature", but not "robust" code.
Does that make sense?
RO
I am curious. Did this vulnerability originate in the Mach microkernal, or one of those other parts listed above? In something Apple added or modified? My first thought upon reading this discussion was that the BSD "base" (as I had understood to be the origins of MacOS X, having forgotten about the Mach part), was to wonder if any of the BSD's shared the flaw (although I doubt that OpenBSD would be likely to ;-)
Just trying to get a clearer understanding.
TIA,
RO
OMG! A Google search for two words shows up some hits! Most of which appear to say that there are one or two bits of malware for the Mac.
If you watch Apple's ads carefully, they don't claim there is no malware for the Mac. They only imply that it doesn't affect your user experience the same way it does on Windows. I think one of the actual statements goes something like "there aren't hundreds of thousands of viruses." Which is absolutely true.
You may find the commercials annoying (don't you find all commercials annoying?), and they are arguably misleading on other points, but that's not one of them.
http://www.google.nl/search?q=malware+mac says it all. Now get those ads off the air.
Why? Because that brings up some "Malware on the Rise" and "Malware proof your system" articles? http://www.google.com/#hl=en&source=hp&q=linux+malware Brings up some articles just like that. Should we then assume that Linux is a growing haven of security holes and seedy malware? I don't think so and I don't know why you got modded informative.
?
You can find a major privilege escalation hole in Finder quite easily :
http://ask.metafilter.com/131473/Does-this-create-a-local-root-exploit-for-Mac-OS-X-using-Finder
Finder isn't setgid but may access any gid!
The Christian religion has been and still is the principal enemy of moral progress in the world. -- Bertrand Russell
I RTFA, but it lacked an example of the bugs use in the wild for reals and/or by accident. I am an Apple user and maybe I am the only one to admit it, but my Mac hangs and parts crash sometimes. Is this a likely and occasional culprit?
6.8SPC TR of 550, l xwind at 6, drift rt at 26" drops 77". AT has 503 ft-lbs at 1403 fps. FT 0.86
Who is this twitter you speak off.
A notorious sockpuppet troll on Slashdot.
Given that the bug is in tty handling, I wouldn't be surprised if some of this code dates back to 4BSD or even earlier (take a look at the change log for the firs OpenBSD release to get an idea of how buggy the original BSD releases were).
I am TheRaven on Soylent News
hmmm, this bug was one of several kernel bugs presented at Cansec'09, if memory serves me right, an exploit for this bug was written in June 2008.
ha. the top hit is from 2007, the next is from 2004. Really drove that point home, eh?
So you can crash a OS X server with a small program if you can get it on there. How does this affect anyone?
- Web Server
-- anyone who can publish code to the web server can crash it. But why would they want to? They just paid to use it!
- Home computer
-- If you install a malware program- it could crash your computer without your permission. It could do worse...like delete your files. Don't worry about this one.
- Data center servers
-- If someone hacks into the system, they could write a program to take down the server. Hmm, that is not what most hackers want to do...they want to get into data. So your biggest concern is the data. But hacking into OS X isn't like hacking into Windows, so again, not something you should lose sleep over.
I guess I'm at a loss to say why this is really a problem. It requires someone to willingly put a bad program on the machine, or for another hack to get you onto the system in question....which to me is far worse than shutting down the machine!! If a hacker shuts down your box, they're doing you a favor.
Sadly I couldn't get my Mac OS X 10.3.9 (PowerPC) machine to panic with the C code.
That's OK, there are bound to be other exploits for a 10.3 machine available for you.
This one gets by for the PowerPC users (if you can somehow ignore Leopard being so spotty, right, that's why they did an entire no-feature release). But there are tons (literally) of Macs belonging to owners with fine, workable machines, who have to chose to be vulnerable, ditch their machines, or switch OS's. Ubuntu 8 LTS seems to have a PPC version at least.
Heck, there are probably some folks who bought the quad-core, liquid cooled G5 towers at EOL with machines still under AppleCare who cannot upgrade to the current OS. STBT, I guess.
PPC to Intel was one such painful inflection point - I'm not sure if CPU to GPU or Macintosh to iPhone Platform will be the next. Not a problem for Apple, the wealthy, or people who can actually get a computer properly recycled, though.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
And they broke WiFi Internet sharing - Doesn't work any more. Comes up, works for about 3 minutes and then 100% failure.
I wonder if they will even bother fixing it, or if they hope to force us all to buy Snow Leopard?