Apple CoreGraphics framework fails to validate the input when parsing CCITT
group 3 encoded data resulting in a heap overflow condition. A small heap memory
allocation can be overflowed with controlled data from the input resulting in
arbitrary code execution in the context of Mobile Safari.
Using a crafted PDF file as an HTML image and combined with a information leakage vulnerability this issue leads to arbitrary code execution. A complete 100% reliable
and portable proof of concept exploit for MobileSafari on IOS7.1.x. can be downloaded from github
Quick links: White paper, PoC Exploit generator in python
Quick links: White paper, PoC Exploit generator in python
Summary
- Title: Apple CoreGraphics Memory Corruption
- CVE Name: CVE-2014-4481
- Permalink: http://blog.binamuse.com/2015/01/coregraphics-ccitt-memory-corruption.html
- Date published: 2015-01-27
- Date of last update: 2015-01-27
- Class: Client side / Integer Overflow / Memory Corruption
- Advisory: HT204245
Vulnerability Details
Safari accepts PDF files as native image format for the < image > html tag. Thus browsing an html page in Safari can transparently load multiple pdf files without any further user interaction. CoreGraphics is the responsible of parsing the PDF files.Apple Core Graphics framework fails to validate the input when parsing CCITT group 3 encoded data. A small heap memory allocation can be overflowed with controled data from the input enabling arbitrary code execution in the context of Mobile Safari.
The Core Graphics framework is a C-based API that is based on the Quartz advanced drawing engine. It provides low-level, lightweight 2D rendering. This is used in a wide range of applications to handle path-based drawing, transformations, color management, offscreen rendering, patterns, gradients and shadings, image data management, image creation, masking, and PDF document creation, display, and parsing.
CoreGraphics library implements the functionality to load and save several graphic formats such as PDFs and it is used by most common applications that deal with images, including Safari, Preview, Skype, etc. The 32 bit version of the framework also implements the x_malloc heap, a set of low level procedures to manage an internal heap memory structure used when processing images of different types (including PDF files). The functions x_malloc and x_free are used very frequently to allocate and de-allocate memory fast.
The x_malloc function behaves as a normal malloc except it allocates a bit extra memory for metadata. It actually allocates an extra 2*sizeof(void*) bytes and pad the resulting size to the next 16 byte border. When the chunk is in use (allocated) this extra space is used to hold the size of the chunk, thus making it super fast to free. On the other hand when the chunk is free the metadata space is used to form a free-list linked list, the first metadata value in a free chunk points to the next free chunk. This is its pseudocode. Think x_mem_alloc0_size as a plain malloc.
void * __cdecl x_malloc ( size_t size ) { void * buffer = x_mem_alloc0_s ize (( size + 31) & -16) ; *( size_t *) buffer = ( size + 31) & -16; return buffer + 16; }This function is prone to integer overflow because it doesn’t check for size to be less than MAXUINT-16. Then if a programmer tries to allocate a size in the range [-16,-1] x_malloc will allocate 0(zero) or 16 bytes (instead of the immense value required) without triggering any exception.
CCITTFaxDecode group 3 x_malloc bug
A x_malloc bug is triggered when decoding CCITT group 3 compressed data. The CCITTFaxDecode pdf filter decodes image data that has been encoded using either Group 3 or Group 4 CCITT facsimile (fax) encoding. CCITT encoding is designed to achieve efficient compression of monochrome (1 bit per pixel) image data at relatively low resolutions, and so is useful only for bitmap image data, not for color images, grayscale images, or general data. Any PDF Stream can be compressed using a different set of filters as described in PDFSPEC::7.3.8::Streams. Under certain conditions the implelentation of the CCITTFaxDecode filter fails to allocate the correct amount of memory for its internal state. It allocates an overly small array that can be overflowded with controlled data. The decoding parmeters of any pdf filter are controled via the /decodeparams field of the stream dictionary. The CCITTFaxDecode filter parses its decoding parameters at the function pdf_source_create_ccitt_fax_filter (see appendix for pseudocode). After the decode parameters are parsed an validated the CCITTFaxDecode internal state is allocated at functions pdf_FaxDecodeStateAlloc. Setting a /Columns value of 0x3fffffff-4 enables the attacker to reach x_malloc with a size in the [16,-1] range (without trigering any exceptions). Thus, the pdf_FaxDecodeStateAlloc function will reseve a small amount of memory for holding a potentially big array of encoded CCITT group3 1D runlenghts values (See rfc804). PDF CCITTFaxDecode filter can handle a number of CCITT encodings, K=0 selects the vulnerable code (namely CCITT group 3 or G31D). An example of the /DecodeParams dictionary nedded to reach the vulnerable code follows:
/DecodeParms << /Rows 0
/EndOfBlock true
/K 0
/BlackIs1 true
/EncodedByteAlign false
/Columns 1073741819
/EndOfLine false
>>
The pdf_FaxDecodeStateAlloc function silently fails to reserve enough space to
decode a line of potentially 0x3fffffff-4 runlengths codes. The actual decoding
is done at the function pdf_FaxDecode. This function decodes the input stream of
CCITT G31D encoded runlength. CCITT group 3 works in a line by line pace, at
each line it will iterativelly consume white an black runlengths. Each decoded
runlength is appended to the internaly allocated array of 16 bit words. The
decompression algorithm is best described in [3]. As the attaker controls the
raw input it may craft a list of CCITT runlength codes to overwrite the overly
short 16bit word array with a controlled amount of controlled data.
Function lookup table based on firmware iPhone5,1-7.1.2, follows:
0x2D57C824 pdf_FaxDecodeStateAlloc
0x2D57EF64 pdf_source_create_ccitt_fax_filter
0x2D57C8D8 pdf_FaxDecode
Assume dyld_shared_cache base address is 0x2c00000.
Exploitation
A 100% reliable PoC exploit can be downloaded from the github project. This exploit needs a companion information leakage vulnerability to bypass ASLR, DEP and Code signing iOS exploit mitigations. The exploit is presented as a cgi script that expects to get the dyld_shared_cache address, the shellcode address and the iOS version as GET parameters. It executes arbitrary code in the context of SafariMobile.Listings
int __cdecl pdf_source_create_ccitt_fax_filter(void *arg0, int a1) { ccitt *ccitt; int result; int K; bool flags_a; signed int ccitt_group_; int flags_b; int flags_c; int flags; char blackIsZERO; FaxDecodeState *state; int ccitt_group; char value_bool; int value_int; ccitt = x_calloc(1, 32); result = 0; if ( ccitt ) { ccitt->K = 0; ccitt->EOL = 0; ccitt->EncodedByteAlign = 0; ccitt->Columns = 1728; ccitt->Rows = 0; ccitt->EndOfBlock = 1; ccitt->BlackIs1 = 0; ccitt->DamagedRowsBeforeError = 0; if ( a1 ) { if ( CGPDFDictionaryGetInteger(a1, "K", &value_int) ) ccitt->K = value_int; if ( CGPDFDictionaryGetBoolean(a1, "EndOfLine", &value_bool) ) ccitt->EOL = value_bool != 0; if ( CGPDFDictionaryGetBoolean(a1, "EncodedByteAlign", &value_bool) ) ccitt->EncodedByteAlign = value_bool != 0; if ( CGPDFDictionaryGetInteger(a1, "Columns", &value_int) ) { if ( value_int < 0 ) pdf_error("/%s is outside the range of allowed values.", "Columns"); else ccitt->Columns = value_int; } v2 = 3793108; if ( CGPDFDictionaryGetInteger(a1, "Rows", &value_int) ) { if ( value_int < 0 ) pdf_error("/%s is outside the range of allowed values.", "Rows"); else ccitt->Rows = value_int; } if ( CGPDFDictionaryGetBoolean(a1, "EndOfBlock", &value_bool) ) ccitt->EndOfBlock = value_bool != 0; if ( CGPDFDictionaryGetBoolean(a1, "BlackIs1", &value_bool) ) ccitt->BlackIs1 = value_bool != 0; if ( CGPDFDictionaryGetInteger(a1, "DamagedRowsBeforeError", &value_int) ) { if ( value_int < 0 ) pdf_error("/%s is outside the range of allowed values.", "DamagedRowsBeforeError"); else ccitt->DamagedRowsBeforeError = value_int; } } K = ccitt->K; if ( K < 0 ) { ccitt_group_ = 4; flags_a = 0; } else { flags_a = K > 0; ccitt_group_ = 3; } ccitt_group = ccitt_group_; flags_b = flags_a + 2; if ( !ccitt->EOL ) flags_b = flags_a; flags_c = flags_b | 4; if ( !ccitt->EncodedByteAlign ) flags_c = flags_b; if ( ccitt->EndOfBlock ) { ccitt->Rows = 0; flags_c |= 8u; } flags = flags_c | 0x10; blackIsZERO = ccitt->BlackIs1 == 0; LOBYTE(ccitt->flags) = 0; if ( !blackIsZERO ) flags = flags_c; ccitt->source = CGPDFSourceRetain(arg0); state = pdf_FaxDecodeStateAlloc(ccitt->Columns, ccitt_group, flags); ccitt->fax_decode_state = state; if ( !state || (state->getc = (ccitt_fax_filter_getc), ccitt->fax_decode_state->stream = arg0, (result = CGPDFSourceCreateFilter( ccitt, (ccitt->Columns + (((ccitt->Columns + 7) >> 31) >> 29) + 7) >> 3, &pdf_source_create_ccitt_fax_filter_callbacks)) == 0) ) { ccitt_fax_filter_finalize(ccitt); result = 0; } } return result; }
FaxDecodeState *__cdecl pdf_FaxDecodeStateAlloc(int columns, int group, int flags) { FaxDecodeState *retval; int size; FaxDecodeState *state; int N; _WORD *buf; unsigned int last; int ptr; char is4; retval = 0; size = columns; if ( columns <= 0x3FFFFFFF ) { state = x_calloc(1, 0x38); if ( state ) { state->group = group; state->flags = flags; state->columns = columns; state->columns_rnd = (columns + (((columns + 7) >> 31) >> 29) + 7) >> 3; is4 = (group == 4) | flags & 1; if ( is4 ) size = (2 * columns + 62) & 0xFFFFFFC0; N = 2 * size + 3; if ( N >= 0 ) { buf = x_malloc(2 * N); state->line_buffer = buf; if ( buf ) { state->line_buffer2 = buf; last = size >> 1; if ( is4 & 1 ) size = size >> 1; state->N = size; if ( is4 & 1 ) { ptr = &buf[last]; state->tail = ptr; } else { state->tail = 0; ptr = 0; } state->code_bitcount = 0; state->bitaccu = 0; state->field_18 = 0; retval = state; if ( ptr ) { *ptr = LOWORD(state->columns); *(ptr + 2) = 0; retval = state; } } } } } return retval; }
C Structures
The structures used. 00000000 ccitt struc ; (sizeof=0x20) 00000000 source dd ? 00000004 flags dd ? 00000008 K dd ? 0000000C Rows dd ? 00000010 Columns dd ? 00000014 EOL db ? 00000015 EncodedByteAlign db ? 00000016 EndOfBlock db ? 00000017 BlackIs1 db ? 00000018 DamagedRowsBeforeError dd ? 0000001C fax_decode_state dd ? ; offset 00000020 ccitt ends 00000020 00000000 ; --------------------------------------------------------------------- 00000000 00000000 FaxDecodeState struc ; (sizeof=0x38) 00000000 group dd ? 00000004 flags dd ? ; 0x10 BlackIsZero0 00000004 ; 0x08 EndOfBlock 00000004 ; 0x04 EncodedByteAlign 00000004 ; 0x02 EOL 00000004 ; 0x01 K>0 00000008 columns_rnd dd ? 0000000C columns dd ? 00000010 bitaccu dd ? 00000014 code_bitcount dd ? 00000018 field_18 dd ? 0000001C line_buffer dd ? ; offset 00000020 tail dd ? ; offset 00000024 line_buffer2 dd ? ; offset 00000028 N dd ? 0000002C field_2C dd ? 00000030 getc dd ? ; offset 00000034 stream dd ? ; offset 00000038 FaxDecodeState ends 00000038
