Apple OS X Scene Kit DAE XML Code Execution Vulnerability(CVE-2016-1850)

### SUMMARY An exploitable type confusion vulnerability exists in the handling of DAE images on OS X. A crafted DAE document can trigger a type confusion vulnerability which potentially could be exploited to achieve attacker controlled code execution. Vulnerability can be triggered via a saved DAE file delivered by other means. ### TESTED VERSIONS OSX El Capitan - 10.11.4 ### PRODUCT URLs https://developer.apple.com/scenekit/ ### CVSSv3 SCORE 7.4 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U ### DETAILS This vulnerability is present in the Apple Scene Kit API which is used for all 3D image handling on OS X including most 3rd party 3D applications. There exists a vulnerability inside of Scene Kit in the parsing and handling of DAE images. A specially crafted DAE image file can lead to a type confusion vulnerability and ultimately to control. COLLADA defines an open standard XML schema for exchanging digital assets among various graphics software applications that might otherwise store their assets in incompatible file formats. COLLADA documents that describe digital assets are XML files, usually identified with a .dae (digital asset exchange) filename extension. In the XML it i possible to specify and create custom objects to be used by the renderer. Invalid checking allows a user to pass in an object that doesn't have the proper properties and gets illegally accessed. The inital crash is shown below: ``` RAX: 0x0000000000000000 RBX: 0x000000010072F428 RBP: 0x00007FFF5FBFD160 RSP: 0x00007FFF5FBFD130 o d I t s z a P c RDI: 0x000000010072F428 RSI: 0x00000001007AA702 RDX: 0xFFFFFFFFFFFFFFFF RCX: 0x0000000200000000 RIP: 0x000000010078DC5F R8: 0x0000000126A21FC0 R9: 0x00000001008E8128 R10: 0x00000001008E7AA8 R11: 0x00000001007A9BF6 R12: 0x480006B018E8DF3C R13: 0x0000000126A21FC0 R14: 0xFFFFFFFFFFFFFFFF R15: 0x00000001007AA702 CS: 002B FS: 0000 GS: 0000 ``` SceneKit`(anonymous namespace)::getAttributeIndex: -> 0x10078dc5f <+33>: mov r13, qword ptr [r12 + 0x30]` ``` 0x10078dc64 <+38>: test r13, r13 0x10078dc67 <+41>: je 0x10078dca0 ; <+98> 0x10078dc69 <+43>: xor ebx, ebx 0x10078dc6b <+45>: cmp r13, rbx 0x10078dc6e <+48>: jbe 0x10078dcb2 ; <+116> 0x10078dc70 <+50>: mov rax, qword ptr [r12 + 0x40] 0x10078dc75 <+55>: mov rax, qword ptr [rax + 8*rbx] (lldb) bt * thread #1: tid = 0x720797, 0x000000010078dc5f SceneKit`(anonymous namespace)::getAttributeIndex(daeElement&, char const*) + 33, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT) * frame #0: 0x000000010078dc5f SceneKit`(anonymous namespace)::getAttributeIndex(daeElement&, char const*) + 33 frame #1: 0x000000010078edbd SceneKit`daeElement::getID() const + 33 frame #2: 0x000000010041a578 SceneKit`C3DIO_COLLADA_CreateUniqueIDForEntityWithExtraString + 22 frame #3: 0x0000000100413ff0 SceneKit`C3DIO_COLLADA_ReadGeometry(domGeometry*, __C3DLibrary*, __CFArray*, __CFDictionary*, __CFDictionary const*, bool) + 348 frame #4: 0x0000000100415173 SceneKit`C3DIO_COLLADA_ReadGeometryInstance(daeSmartRef<domInstance_geometry>, __C3DLibrary*, __C3DNode*, __CFDictionary const*) + 162 frame #5: 0x000000010042a5ca SceneKit`C3DIO_COLLADA_ReadNode(daeSmartRef<domNode>, __C3DNode*, __C3DLibrary*, __CFDictionary*) + 2056 ``` It is seen that R12 is an out of bounds user controlled value and that this crashing function was called from ReadGeometry assuming the object passed in was a geometry type object. Looking at our DAE file we can see what caused the crash. ``` <node id="Box" name="Box"> <rotate sid="rotateZ">0 0 1 0</rotate> <rotate sid="rotateY">0 1 0 0</rotate> <rotate sid="rotateX">1 0 0 0</rotate> <!-- pointLightShape1 is a light object not a geometry object thus has different properties causing the illegal access --> <instance_geometry url="#pointLightShape1-lib"/> <instance_light url="#ambientLight-lib"/> </node> ``` By looking at the DAE file itself the problem becomes readily apparent. If an attacker was able to shape an object in such a way as to bypass this illegal access and continue on to the virtual call they could gain full remote code execution. ### CRASH INFORMATION ``` Crashed thread log = : Dispatch queue: com.apple.main-thread 0 com.apple.SceneKit 0x000000010be9dc5f (anonymous namespace)::getAttributeIndex(daeElement&, char const*) + 33 1 com.apple.SceneKit 0x000000010be9edbd daeElement::getID() const + 33 2 com.apple.SceneKit 0x000000010bb2a578 C3DIO_COLLADA_CreateUniqueIDForEntityWithExtraString + 22 3 com.apple.SceneKit 0x000000010bb23ff0 C3DIO_COLLADA_ReadGeometry(domGeometry*, __C3DLibrary*, __CFArray*, __CFDictionary*, __CFDictionary const*, bool) + 348 4 com.apple.SceneKit 0x000000010bb25173 C3DIO_COLLADA_ReadGeometryInstance(daeSmartRef<domInstance_geometry>, __C3DLibrary*, __C3DNode*, __CFDictionary const*) + 162 5 com.apple.SceneKit 0x000000010bb3a5ca C3DIO_COLLADA_ReadNode(daeSmartRef<domNode>, __C3DNode*, __C3DLibrary*, __CFDictionary*) + 2056 6 com.apple.SceneKit 0x000000010bb28ae6 C3DIO_COLLADA_LoadScene + 6010 7 com.apple.SceneKit 0x000000010bb3c10f C3DSceneSourceCreateSceneAtIndex + 301 8 com.apple.SceneKit 0x000000010bc31348 -[SCNSceneSource _createSceneRefWithOptions:statusHandler:] + 1056 9 com.apple.SceneKit 0x000000010bc31b20 -[SCNSceneSource _sceneWithClass:options:statusHandler:] + 838 10 com.apple.SceneKit 0x000000010bc31d63 -[SCNSceneSource sceneWithClass:options:statusHandler:] + 39 11 com.apple.Preview 0x000000010b7607dd 0x10b716000 + 305117 12 com.apple.Preview 0x000000010b71b731 0x10b716000 + 22321 13 com.apple.Preview 0x000000010b809fb6 0x10b716000 + 999350 14 libdispatch.dylib 0x00007fff9c53693d _dispatch_call_block_and_release + 12 15 libdispatch.dylib 0x00007fff9c52b40b _dispatch_client_callout + 8 16 libdispatch.dylib 0x00007fff9c53ec1c _dispatch_main_queue_callback_4CF + 1685 17 com.apple.CoreFoundation 0x00007fff8e4a39e9 __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 9 18 com.apple.CoreFoundation 0x00007fff8e4628dd __CFRunLoopRun + 1949 19 com.apple.CoreFoundation 0x00007fff8e461ed8 CFRunLoopRunSpecific + 296 20 com.apple.HIToolbox 0x00007fff95160935 RunCurrentEventLoopInMode + 235 21 com.apple.HIToolbox 0x00007fff9516076f ReceiveNextEventCommon + 432 22 com.apple.HIToolbox 0x00007fff951605af _BlockUntilNextEventMatchingListInModeWithFilter + 71 23 com.apple.AppKit 0x00007fff9971aefa _DPSNextEvent + 1067 24 com.apple.AppKit 0x00007fff9971a32a -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 454 25 com.apple.AppKit 0x00007fff9970ee84 -[NSApplication run] + 682 26 com.apple.AppKit 0x00007fff996d846c NSApplicationMain + 1176 27 libdyld.dylib 0x00007fff911725ad start + 1 log name is: ./crashlogs/_Users_t_Downloads_dae-report_type_confusion_dae.crashlog.txt --- exception=EXC_BAD_ACCESS:signal=11:is_exploitable= no:instruction_disassembly=movq CONSTANT(%r12),%r13:instruction_address=0x000000010be9dc5f:access_type=read:access_address=0x0000000000000000: The exception code indicates that the access address was invalid in the 64-bit ABI (it was > 0x0000800000000000). Crash accessing invalid address. Consider running it again with libgmalloc(3) to see if the log changes. + EXIT_VALUE=11 + exit 11 ``` ### TIMELINE * 2016-05-16 - Vendor Disclosure * 2016-07-18 - Patch released