Posix spawn kernel information leak

Vulnerability used in p0sixspwn

Vulnerability Part 1

There is an information leak vulnerabilty, which can be exploited to retrieve leaked bytes from the kernel heap. If you carefully craft the data's size, you can leak bytes from the heap using a PSFA_OPEN file action. The Size is crafted so that the beginning of the file name is within the buffer and the rest is taken in the heap, then you can use fcntl(F_GETPATH) to get the leaked bytes.

Vulnerability Part 2

The posix_spawn() vulnerability isn't just a way to leak memory, this is also a race condition exploit, but you need a way to re-read the memory, and then write outside the buffer, then finaally you need to sync with a secondary thread via file locking. Like this open(..., O_EXLOCK ). The p0sixspwn jailbreak also utilizes another exploit to change the fd_ofileflags relocation path.

Credit

I0n1c

Links

Writeup by i0n1c p. 20 ff.