October 24, 2009 | 9 minutes
Runtime binary loading via the dynamic loader on Apple Mac OS X
An article written by Dan Goodin from The Register was recently published, it mentions a forthcoming presentation by Vincenzo Iozzo, which presents a method to load a binary on runtime, directly from memory, in Mac OS X systems.
Here we like to stick to the technical side of things… so let’s get started on explaining how this can be done, in case you aren’t planning to attend Black Hat or just feel particularly curious on the topic!
Apple Mac OS X 10.4 temp_patch_ptrace(): Nonsense in kernel-land
Several software vendors realized, sometime during the 1990-2000 time-frame, that exporting system call tables within kernel address space was a bad idea. This obviously doesn’t mean anything to Red Hat and other GNU/Linux vendors who are happily providing world readable System.map files. Not like anybody needs them, though.
Then again, you have to face potential funniness of contradictory measures, like Apple’s own mistakes. This article won’t talk about yet another bug introduced by a Linux developer working at Red Hat (and later silently fixed by another employee of the very same company), but an interesting issue with Mac OS X 10.4 systems on PowerPC.
Linux Kernel Silent Patching: VMI write_ldt_entry() local privilege escalation
Once again, the Linux kernel developers delight us with their always discreet (meaning: silent, no-advisory, no-warning policy) and wonderful patching practices. Sometime between 2.6.24 and 2.6.25 a patch from a Red Hat developer was committed into the Linux kernel git tree, implementing changes to the VMI interfaces hooking some functions dealing with the GDT and LDT.
diff --git a/arch/x86/kernel/vmi_32.c b/arch/x86/kernel/vmi_32.c
index 6ca515d..edfb09f 100644
--- a/arch/x86/kernel/vmi_32.c
+++ b/arch/x86/kernel/vmi_32.c
@@ -235,7 +235,7 @@ static void vmi_write_ldt_entry(struct desc_struct *dt, int entry,
const void *desc)
{
u32 *ldt_entry = (u32 *)desc;
- vmi_ops.write_idt_entry(dt, entry, ldt_entry[0], ldt_entry[1]);
+ vmi_ops.write_ldt_entry(dt, entry, ldt_entry[0], ldt_entry[1]);
}
static void vmi_load_sp0(struct tss_struct *tss,
The original commit mentions that it was discovered when JRE caused failures, confirming that it could obviously be triggered by unprivileged user-land processes. It affects only x86 VMI guests.
Latest posts
-
Why Linux security has failed (for the past 10 years)
October 24, 2009
-
Runtime binary loading via the dynamic loader on Apple Mac OS X
February 6, 2009
-
Apple Mac OS X 10.4 temp_patch_ptrace(): Nonsense in kernel-land
November 3, 2008
-
Linux Kernel Silent Patching: VMI write_ldt_entry() local privilege escalation
October 28, 2008