#HITB2019AMS D1T1 - Finding Vulnerabilities In iOS/MacOS Networking Code

### Overview In this presentation, Kevin Back, a security researcher at Semmle, shares his journey of discovering multiple vulnerabilities within the Apple XNU kernel, which is shared across both macOS and iOS. Transitioning from a background as a compiler engineer with no prior hacking experience before 2017, Back explains how using QL—Semmle's semantic code analysis query language—allowed him to identify integer overflows, buffer overflows, and infinite loops in low-level networking code across three primary areas: the packet mangler, the NFS client, and ICMP error handling.

### Key Topics - **Static Analysis via QL**: Formulating queries based on tainted data flows and range analysis to pinpoint unsafe operations on network buffers (`mbuf`) and memory copying routines (`bcopy`, `mbuf_copydata`). - **XNU Kernel Networking Architecture**: Exploring the structure of network data representation in XNU, including the linked-list nature of `mbuf` chains, helper functions like `m_pulldown`/`m_pullup`, and raw TCP/IP packet parsing. - **Vulnerability Case Studies**: - *Packet Mangler Bugs*: Stack buffer overflow and infinite loop denial-of-service issues in vestigial kernel code. - *NFS Client Vulnerabilities*: Heap and stack buffer overflows triggered by untrusted file handle lengths delivered from a rogue NFS server. - *ICMP Error Handling Bug*: Remote kernel crash on vanilla iOS and macOS triggered over local Wi-Fi via malformed IP options. - **Vendor Response & Incomplete Fixes**: Apple's tendency to patch only the exact symptoms of supplied proof-of-concept exploits, leaving identical root-cause variants unfixed across multiple releases.

### Technical Details 1. **Packet Mangler (`CVE-2017-13904` and variants)**: Back initially searched for array index expressions containing additions susceptible to integer overflows. He uncovered an unchecked loop traversing TCP options where signed conversions (`char` for option lengths) and insufficient boundary checks allowed attacker-controlled negative offsets or zero increments, producing kernel infinite loops. Furthermore, missing verification of the data offset field in the TCP header (which must be at least 5) allowed an underflow; when passed to `mbuf_copydata` and cast to `size_t`, this resulted in an enormous copy size and a stack buffer overflow. However, exploiting this required the packet mangler to be enabled, which requires root privileges and is rarely used.

2. **NFS Client (`NFS v3 / v4`)**: Recognizing that XNU uses specialized routines such as `bcopy`, `mbuf_copydata`, `m_data`, and `mtod` instead of standard C library functions, Back designed data-flow queries tracking tainted pointers from `mbuf` into copy sizes. In `nfs_subs.h`, macros like `nfsm_getfh` and `nfsm_getopaque` failed to validate the 32-bit `fh_len` returned by an NFS server against protocol bounds (64 bytes for NFSv3). This allowed an oversized file handle to be copied directly into kernel memory, enabling stack or heap corruption. Back verified this by crafting a custom rogue NFSv3 server in just 63 lines of RPC language and 46 lines of C using `rpcgen` and mounting it from an unprivileged macOS guest account.

3. **ICMP Error Packet Construction (`icmp_error`)**: Back created data-flow queries tracking tainted data from `mtod` directly into `m_copydata` in `icmp_error`. Restricting sources to `ip_input` and excluding `ip_forward`, he discovered that sending an incoming IP packet with an invalid IP option triggered an ICMP error packet generation. The handler attempted to echo back the incoming packet's contents. By crafting a packet with maximum-sized IP options (40 bytes) and TCP options (40 bytes) totaling 120 bytes, the kernel was forced into a buffer overflow and crashed. Ian Beer later clarified that the crash resulted from improper `uint32_t` casting earlier in the option-processing code.

### Takeaways Back stresses that massive, monolithic, and deeply inlined functions in XNU networking code—such as `tcp_input`, spanning over 3,000 lines—are heavily prone to human error and low-level boundary mistakes. Furthermore, security researchers should re-examine vendor patches closely: Apple's initial fixes merely altered relational checks or addressed explicit PoC vectors without addressing the broader macro or logical flaw, enabling multiple follow-up CVEs.