Full Report
Sometimes, the vulnerability is not the issue itself - it's finding a fruitful attack surface. In this paper, the authors discuss the overlooked OS X attack surface of the userland and kernel graphics components. The reason these were likely overlooked was because they are not listed in the sandbox profile. The WindowServer also has very high privileges on the OS. CVE-2014-1314, not found by the authors, was a funny design flaw. When creating a CoreGraphics session, it will send a request to start a process under the user's context. However, user's can specify an arbitrary script to run upon login. So, this creates a process that is outside of the sandboxing. Neat! The first interesting bug they discuss is a double free. This is triggered when setting an invalid ForceConfig for touches. The time window for the two frees is very small. Luckily, triggering the bug without winning the race doesn't crash, allowing for a brute-force attempt on this. The CFPropertyListCreateWithData API takes in Unicode strings, which was a good target for overwriting the memory we wanted. An additional win is that the randomization on large blocks of memory is very bad. The next target is the IOAccelSurface interface used by Apple's Graphics Driver. It represents an area of a rectangle that will be rendered by the GPU. It appears to have been designed for WindowsServer to use but normal processes can also call it. Hence, it's likely a fairly software target. The article discusses the internal workings of this driver, which required a lot of reverse engineering to do. When doing some rectangle scaling, there is a lack of input validation for sane values. The incoming surfaces height is expected to be less than 0x4000. By providing a value larger than this, the condition of y 16705, x 321, height -1, len -1 is possible to hit. Before bailing out, a single out of bounds write will occur. Using linear out-of-bounds write ahead of the current chunk, we need to corrupt something useful. If an IG Vector can be placed ahead of this chunk, we can create a fake IG Vector with pointers to sensitive locations. Also, we control the values being written in these locations, giving us an arbitrary write-what-where primitive. Since floats have a limited range, this does limit the values we can write. In effect, this gives the attacker a relative pointer corruption. Although we can't overwrite the whole thing, we can overwrite parts of pointers. Additionally, these values are good for corrupting a structure's size. In this case, the authors used the OOB write to corrupt a IOUserClient objects pointer. The goal was to corrupt this to point to data that the attacker controls on the heap. Getting this object in the proper spot via feng shui is discussed as well, and it's worth a read! The OOB write is used to get both an infoleak via reading VTable pointers. The trick was to change the offset to be read out to read the pointer byte by byte. Within the same object is a VTable pointer that can also be overwritten to achieve RIP control by pointing it to a spot on the heap that we control. Even though the paper is 8 years old, there is still so much to learn. Good paper!
Analysis Summary
# Research: Exploring the Overlooked OS X Graphics Attack Surface
## Metadata
- **Authors:** (Not explicitly named in source; commonly associated with researchers like Ian Beer or similar Pwn2Own-era contributors)
- **Institution:** Independent Security Research
- **Publication:** Analysis of OS X Userland and Kernel Graphics Components
- **Date:** Circa 2014 (Based on CVE-2014-1314 reference)
## Abstract
This research explores the high-privilege, often-overlooked attack surfaces within the OS X (macOS) graphics stack, specifically focusing on the `WindowServer` userland process and the `IOAccelSurface` kernel interface. By identifying flaws in input validation and sandbox exclusions, the authors demonstrate how to bypass environment restrictions and escalate privileges through sophisticated heap manipulation and Out-of-Bounds (OOB) writes.
## Research Objective
The research aims to identify and exploit vulnerabilities in components that are omitted from standard sandbox profiles, specifically targeting the OS X graphics subsystem to achieve arbitrary code execution and kernel-level access.
## Methodology
### Approach
- **Attack Surface Analysis:** Mapping components like `WindowServer` that operate with high privileges but lack stringent sandbox restrictions.
- **Reverse Engineering:** Deep analysis of the Apple Graphics Driver and the `IOAccelSurface` interface to understand undocumented scaling logic.
- **Fuzzing/Manual Review:** Testing API inputs (e.g., `ForceConfig` for touches) to identify race conditions and memory corruption bugs.
- **Heap Feng Shui:** Strategically placing objects in memory to ensure predictable corruption during OOB writes.
### Dataset/Environment
- OS X operating system (Version circa 10.9/10.10).
- Userland processes (`WindowServer`) and Kernel-mode drivers (Intel/AMD Graphics drivers).
### Tools & Technologies
- Reverse engineering tools (e.g., IDA Pro/Hopper).
- Kernel debuggers.
- Custom exploitation scripts for heap grooming and brute-forcing race conditions.
## Key Findings
### Primary Results
1. **Sandbox Escapes via Design Flaws:** CVE-2014-1314 revealed that `CoreGraphics` could be coerced into launching processes under the user context using arbitrary login scripts, effectively bypassing the sandbox.
2. **Brute-Forceable Race Conditions:** A double-free vulnerability in the `ForceConfig` touch settings was found to be exploitable via brute force because failed attempts did not crash the system.
3. **Weak Entropy in Large Allocations:** Large memory blocks in OS X exhibited poor randomization, facilitating predictable memory corruption.
4. **Kernel OOB Write:** Lack of input validation in `IOAccelSurface` rectangle scaling allowed for a single, controlled Out-of-Bounds write.
### Novel Contributions
- **Relative Pointer Corruption:** Demonstrated how to use floating-point values (despite their limited range) to partially overwrite pointers and corrupt object sizes.
- **VTable Manipulation:** A technique to turn a limited OOB write into an information leak (reading VTable pointers byte-by-byte) and subsequent RIP control.
## Technical Details
The core kernel exploit targets the `IOAccelSurface` scaling logic. The driver expects a maximum surface height of `0x4000`. By providing a value exceeding this, an attacker can bypass sanity checks and trigger an OOB write during coordinate calculation (hitting coordinates like `y 16705, x 321`).
By using **Heap Feng Shui**, the authors placed an `IOUserClient` object ahead of the vulnerable chunk. The OOB write was used to corrupt the `IOUserClient` pointer to point to attacker-controlled data. This allowed the researchers to:
1. **Information Leak:** Modify offsets to read the VTable pointer back to userland.
2. **Code Execution:** Overwrite the VTable pointer to redirect execution to a heap-based ROP chain or shellcode, granting full control over the Instruction Pointer (RIP).
## Practical Implications
### For Security Practitioners
- **Attack Surface Discovery:** Look beyond what is documented. If a service isn't in a sandbox profile, it is a primary target.
- **Race Condition Reliability:** Not all race conditions lead to immediate crashes; "silent" failures are a gift to attackers for brute-forcing.
### For Defenders
- **Input Validation:** Ensure all kernel-exposed interfaces (even those intended only for system services like `WindowServer`) strictly validate dimensions, lengths, and scaling factors.
- **Sandbox Hardening:** Explicitly deny access to graphics interfaces for sandboxed applications unless strictly necessary.
### For Researchers
- **Legacy Components:** Older graphics drivers often contain complex, legacy code that was never audited for modern "sandbox-aware" threat models.
## Limitations
- **Floating Point Constraints:** Using floats for arbitrary writes limits the precision of the values that can be written, necessitating "relative" rather than "absolute" corruption in some cases.
- **Race Condition Timing:** The double-free window is extremely small, requiring high-frequency attempts to succeed.
## Comparison to Prior Work
While previous research focused on Mach ports and standard syscalls, this work highlighted the **Graphics Driver** as a viable and less-guarded path from the userland to the kernel, moving the focus from logic bugs to complex memory corruption in hardware-acceleration interfaces.
## Real-world Applications
- **Privilege Escalation:** Elevating from a restricted user/sandboxed app to Kernel privileges.
- **Exploit Chains:** Often used as the second or third stage in a browser exploit chain to break out of the renderer sandbox.
## Future Work
- Investigation of newer Metal API components for similar validation flaws.
- Analyzing the impact of modern mitigations like PAC (Pointer Authentication Codes) on these VTable corruption techniques.
## References
- CVE-2014-1314 (CoreGraphics Process Execution)
- Apple IOKit Documentation (IOAccelSurface)
- *Related research:* hxxp[://]project-zero[.]blogspot[.]com (General methodology for OS X kernel research)