Really Check Errors: Pointing to the Object of your Desire

In macOS, the Dock is reachable through a Mach service identified by “com.apple.dock.server”. These functions heavily employ the serialization functionality provided by the HIServices framework. The vulnerability was triggered in the DSSetDesktopForDisplayAndSpace function, which was reachable by sending a Mach message with 96548 as the ID.

Let’s take a look at what the DSSetDesktopForDisplayAndSpace function looks like:

This is just the beginning of the function, but we can see some variables are initialized on the stack prior to _UnserializeCFType being called. That function lives in the HIServices, so let’s look at it too:

That isn’t very interesting on its own, but let’s dive deeper anyway. Here’s the AXUnserializeCFType function:

This function first checks to ensure that the fourth argument is at least eight before continuing on. If so, it’ll initialize the fifth argument such that it points to NULL and then attempt to deserialize based on the type of data. If deserialized without error, a pointer to the newly created object will be stored in the fifth argument.

Did you catch the issue? Let’s look at the beginning of the DSSetDesktopForDisplayAndSpace in a different manner that might make it more apparent:

This is the same as the assembly snippet we first looked at, including all of the variable initialization. Now do you see the issue? The stack variable that is used as an argument to UnserializeCFType is never initialized. Execution then makes it to AXUnserializeCFType, which only initializes that pointer if the second argument to UnserializeCFType is at least eight. Immediately after, objc_autorelease is called on the stack variable, which has the same effect as using the autorelease selector. As such, we can get code execution if that variable on the stack can be controlled.

The MWR team took advantage of this by using a function that contained a push rbx instruction that aligned with the offset of the uninitialized stack variable. When that instruction executes, the rbx register points 40 bytes into the Mach msg being processed, which is perfect for controlling the pointer that objc_autorelease will end up operating on.

There were a total of eight methods that had the vulnerable code path, where they also called _UnserializeCFType without initializing the fourth argument or checking the return code, though there were also a couple more that did things correctly. In the correct cases, the return value of _UnserializeCFType was checked to ensure it was successful and the stack variable passed by reference as an argument was initialized to NULL.