{"id":4024,"date":"2025-11-25T14:30:33","date_gmt":"2025-11-25T05:30:33","guid":{"rendered":"https:\/\/h4ck.kr\/?p=4024"},"modified":"2025-11-25T14:31:13","modified_gmt":"2025-11-25T05:31:13","slug":"%ec%8b%a4%ec%8a%b5-cve-2021-30937multicast_bytecopy-%ec%9d%b4%ed%95%b4%ed%95%98%ea%b8%b0-macos-12-0-1-ios-15","status":"publish","type":"post","link":"https:\/\/h4ck.kr\/?p=4024","title":{"rendered":"[\uc2e4\uc2b5] CVE-2021-30937(multicast_bytecopy) \uc774\ud574\ud558\uae30 (macOS 12.0.1 \/ iOS 15)"},"content":{"rendered":"\n

\ubc84\uadf8 \uc54c\uc544\ubcf4\uae30<\/h1>\n

bsd\/netinet\/in_mcast.c<\/code>\ud30c\uc77c\uc758 inp_join_group<\/code> \ud568\uc218\uc5d0\uc11c \ub808\uc774\uc2a4 \ucee8\ub514\uc158\uc73c\ub85c heap use-after-free\uac00 \ubc1c\uc0dd\ud560 \uc218 \uc788\ub294 \ucde8\uc57d\uc810\uc774\ub2e4.<\/p>\n

\ud574\ub2f9 \ucde8\uc57d\uc810\uc740 \ud2b9\uc815 \uc870\uac74\uc5d0\uc11c \ubc1c\uc0dd\ud558\ub294\ub370, \ud328\uce58\ub418\uc9c0 \uc54a\uc740 xnu-8019.41.5<\/a> \uc18c\uc2a4\ucf54\ub4dc\ub97c \ucc38\uace0\ud558\uba74\uc11c \uc0b4\ud3b4\ubcf4\uaca0\ub2e4.<\/p>\n

inp_join_group<\/code> \uc5d0\uc11c \uc0c8\ub85c\uc6b4 membership \uc5d4\ud2b8\ub9ac\ub97c \uc0dd\uc131\ud560 \ub54c, \ud574\ub2f9 \ud568\uc218\ub294 [4]\ubc88 \ud56d\ubaa9<\/strong>\uc778 socket_unlock(inp->inp_socket, 0);<\/code> \uc5d0 \uc758\ud574 socket<\/code>\uacfc ip_moptions<\/code> lock\uc744 \ud574\uc81c\ud55c\ub2e4.<\/p>\n

\"image.png\"<\/p>\n

\uc774\ub7ec\ud55c \uc7a0\uae08 \ud328\ud134\uc740 \ub2e4\uc74c\uacfc \uac19\uc740 \ubb38\uc81c\uac00 \ubc1c\uc0dd\ud560 \uc218 \uc788\ub2e4.<\/p>\n

    \n
  1. \n

    \uc7a0\uae08\uc744 \ud574\uc81c\ud558\uae30 \uc804\uc5d0 \ud568\uc218\ub294 imo_mfilters<\/code> \ubc84\ud37c \ub0b4\ubd80\uc758 \uc8fc\uc18c\ub97c \ub85c\uceec \ubcc0\uc218 imf<\/code>**[3]**\uc5d0 \ud560\ub2f9\ud55c\ub2e4.<\/p>\n

    \"Screenshot<\/p>\n<\/li>\n

  2. \n

    \uc7a0\uae08\uc774 \ud574\uc81c\ub418\uba74**[4]**, \ub3d9\uc2dc \uc2e4\ud589\ub418\ub294 \ub2e4\ub978 inp_join_group<\/code> \ud638\ucd9c\uc774 imo_membership<\/code>\uacfc imo_mfilters<\/code>\ub97c \uc7ac\ud560\ub2f9\ud560 \uc218 \uc788\uc5b4 imf<\/code> \ud3ec\uc778\ud130\uac00 \uc720\ud6a8\ud558\uc9c0 \uc54a\uc744 \uc218 \uc788\ub2e4.<\/p>\n

    \"Screenshot<\/p>\n<\/li>\n

  3. \n

    \uadf8\ub7f0 \ub2e4\uc74c, \uadf8 \ub315\uae00\ub9c1 \ud3ec\uc778\ud130\ub294 in_joingroup<\/code>[5]\uc5d0\uc11c \uc811\uadfc\ub418\uba70,<\/p>\n

    \"Screenshot<\/p>\n<\/li>\n

  4. \n

    \uc7a0\uae08\uc744 \ub2e4\uc2dc \ud68d\ub4dd\ud55c \ud6c4\uc5d0\ub294 imf_commit<\/code>[7]\uc5d0\uc11c \uc811\uadfc\ub41c\ub2e4.\n\ub9c8\uc9c0\ub9c9\uc5d0\ub294 \ucc38\uc870\ub41c \uac1d\uccb4\uc5d0 \uc4f0\uae30\ub97c \uc218\ud589\ud558\ubbc0\ub85c \uc774 \ubc84\uadf8\ub97c \uc545\uc6a9\ud574 \ud799\uc744 \uc190\uc0c1\uc2dc\ud0ac \uc218 \uc788\ub2e4.<\/p>\n<\/li>\n<\/ol>\n

    \"image.png\"<\/p>\n

    \ucde8\uc57d\uc810\uc774 \ubc1c\uc0dd\ud558\ub294 \ucf54\ub4dc\ub294 \uc544\ub798\uc640 \uac19\ub2e4.\n\uc8fc\uc11d\uc5d0\ub294 \uac01 \uc124\uba85\uc5d0 [n] \ud615\uc2dd\uc73c\ub85c, \ud544\uc694\ud55c \ubc88\ud638\ub97c \ub9e4\uaca8\ub450\uc5c8\ub2e4.<\/p>\n

    \/*\n * Join an IPv4 multicast group, possibly with a source.\n *\n * NB: sopt->sopt_val might point to the kernel address space. This means that\n * we were called by the IPv6 stack due to the presence of an IPv6 v4 mapped\n * address. In this scenario, sopt_p points to kernproc and sooptcopyin() will\n * just issue an in-kernel memcpy.\n *\/\nint\ninp_join_group(struct inpcb *inp, struct sockopt *sopt)\n{\n\n\t\/\/...\n\n\t\/*\n\t * Begin state merge transaction at socket layer.\n\t *\/\n\n\tif (is_new) {\n\t\tif (imo->imo_num_memberships == imo->imo_max_memberships) {\n\t\t\terror = imo_grow(imo, 0);\t\/\/ [1]\n\t\t\tif (error) {\n\t\t\t\tgoto out_imo_locked;\n\t\t\t}\n\t\t}\n\t\t\/*\n\t\t * Allocate the new slot upfront so we can deal with\n\t\t * grafting the new source filter in same code path\n\t\t * as for join-source on existing membership.\n\t\t *\/\n\t\tidx = imo->imo_num_memberships; \/\/ [2]\n\t\timo->imo_membership[idx] = NULL;\n\t\timo->imo_num_memberships++;\n\t\tVERIFY(imo->imo_mfilters != NULL);\n\t\timf = &imo->imo_mfilters[idx];  \/\/ [3]\n\t\tVERIFY(RB_EMPTY(&imf->imf_sources));\n\t}\n\n    \/\/ ...\n\n\t\/*\n\t * Begin state merge transaction at IGMP layer.\n\t *\/\n\tif (is_new) {\n\t\t\/*\n\t\t * Unlock socket as we may end up calling ifnet_ioctl() to join (or leave)\n\t\t * the multicast group and we run the risk of a lock ordering issue\n\t\t * if the ifnet thread calls into the socket layer to acquire the pcb list\n\t\t * lock while the input thread delivers multicast packets\n\t\t *\/\n\t\tIMO_ADDREF_LOCKED(imo);\n\t\tIMO_UNLOCK(imo);    \/\/ [4]\n\t\tsocket_unlock(inp->inp_socket, 0);  \/\/ [4]\n\n\t\tVERIFY(inm == NULL);\n\t\terror = in_joingroup(ifp, &gsa->sin_addr, imf, &inm);   \/\/ [5]\n\n\t\tsocket_lock(inp->inp_socket, 0);\n\t\tIMO_REMREF(imo);\n\t\tIMO_LOCK(imo);\n\n\t\tVERIFY(inm != NULL || error != 0);\n\t\tif (error) {\n\t\t\tgoto out_imo_free;\n\t\t}\n\t\timo->imo_membership[idx] = inm; \/* from in_joingroup() *\/   \/\/ [6]\n\t} else {\n        \/\/ ...\n\t}\n\nout_imf_rollback:\n\tif (error) {\n\t\timf_rollback(imf);\n\t\tif (is_new) {\n\t\t\timf_purge(imf);\n\t\t} else {\n\t\t\timf_reap(imf);\n\t\t}\n\t} else {\n\t\timf_commit(imf);    \/\/ [7]\n\t}\n    \/\/ ...\n}\n\n\/*\n * Leave an IPv4 multicast group on an inpcb, possibly with a source.\n *\n * NB: sopt->sopt_val might point to the kernel address space. Refer to the\n * block comment on top of inp_join_group() for more information.\n *\/\nint\ninp_leave_group(struct inpcb *inp, struct sockopt *sopt)\n{\n\t\/\/ ...\n\n\tIMO_LOCK(imo);\n\tidx = imo_match_group(imo, ifp, gsa);   \/\/ [8]\n\tif (idx == (size_t)-1) {\n\t\terror = EADDRNOTAVAIL;\n\t\tgoto out_locked;\n\t}\n\tinm = imo->imo_membership[idx];\n\timf = &imo->imo_mfilters[idx];\n\n    \/\/ ...\n\n\tif (is_final) {\n\t\t\/* Remove the gap in the membership array. *\/\n\t\tVERIFY(inm == imo->imo_membership[idx]);\n\t\timo->imo_membership[idx] = NULL;\n\n\t\t\/*\n\t\t * See inp_join_group() for why we need to unlock\n\t\t *\/\n\t\tIMO_ADDREF_LOCKED(imo);\n\t\tIMO_UNLOCK(imo);    \/\/ [9]\n\t\tsocket_unlock(inp->inp_socket, 0);\n\n\t\tINM_REMREF(inm);\n\n\t\tsocket_lock(inp->inp_socket, 0);\n\t\tIMO_REMREF(imo);\n\t\tIMO_LOCK(imo);\n\n\t\tfor (++idx; idx < imo->imo_num_memberships; ++idx) {    \/\/ [10]\n\t\t\timo->imo_membership[idx - 1] = imo->imo_membership[idx];\n\t\t\timo->imo_mfilters[idx - 1] = imo->imo_mfilters[idx];\n\t\t}\n\t\timo->imo_num_memberships--;\n\t}\n    \/\/ ...\n}\n<\/code><\/pre>\n
    \ud2b8\ub9ac\uac70 \ubc29\ubc95<\/h1>\n
    VMware \ud658\uacbd\uc5d0\uc11c \uad6c\ub3d9\uc911\uc778 \uc778\ud154\ub9e5\uc778 macOS 12.0.1 Moneterey\uc5d0\uc11c POC \ucf54\ub4dc\ub97c \uc2e4\ud589\uc2dc\ucf1c\ubcf4\uc558\ub2e4.<\/p>\n
    \ubc84\uadf8\uac00 \ud2b8\ub9ac\uac70\ub418\ub294\uc9c0 \uc54c\uc544\ubcf4\uae30 \uc704\ud5e4\uc11c\ub294 KASAN\uc774 \uc801\uc6a9\ub41c \ucee4\ub110\uc774 \ud544\uc694\ud558\ub2e4.<\/p>\n
    poc \uad6c\ud604\ubc29\ubc95<\/p>\n
      \n
    1. main \uc4f0\ub808\ub4dc\uc640 thread_func \uc4f0\ub808\ub4dc, \ucd1d 2\uac1c\uc758 \uc4f0\ub808\ub4dc\uac00 \ub3d9\uc2dc\uc5d0 \uac19\uc740 \uc18c\ucf13 \ud30c\uc77c \ub514\uc2a4\ud06c\ub9bd\ud130\uc778 fd\uc5d0 setsockopt \ud568\uc218\ub85c IP_ADD_MEMBERSHIP<\/code> \uc778\uc790\uc640 \ud568\uaed8 \ud638\ucd9c\ud558\ub824\uace0 \ud55c\ub2e4.<\/li>\n
    2. \uadf8 \uc804\uc5d0, \ub808\uc774\uc2f1 \uc911\uc778 \uc2a4\ub808\ub4dc\ub4e4 \uc911 \ud558\ub098\uac00 imo_grow<\/code>**[1]**\ub97c \ud638\ucd9c\uc2dc\ucf1c\uc57c \uc7ac\uad6c\ud604\uc774 \uac00\ub2a5\ud558\ub2e4. \uc774\ub97c \uc704\ud574   imo_mfilters<\/code>\ub97c \uac00\ub4dd \ucc44\uc6cc\uc57c\ud558\ub294 \uc870\uac74\uc774 \uc788\ub2e4. \ub530\ub77c\uc11c for (int j = 0; j < IP_MIN_MEMBERSHIPS - 1; ++j) { \u2026<\/code> \ucf54\ub4dc\uc640 \uac19\uc774 \uac00\ub4dd\ucc44\uc6b0\uace0 \uc788\ub294 \uac83\ucc98\ub7fc \ubcf4\uc778\ub2e4.<\/li>\n
    3. pthread_create<\/code> \ud568\uc218\ub85c \uc4f0\ub808\ub4dc \uc0dd\uc131 \ubc0f \ub3d9\uae30\ud654\ub97c 100000\ubc88 \ub9cc\ud07c \uacc4\uc18d \uc9c4\ud589\ud55c\ub2e4.\n\ub450 \uc2a4\ub808\ub4dc\uc758 setsockopt<\/code> \ud638\ucd9c\uc774 \ucee4\ub110 \ub0b4\uc5d0\uc11c \uac70\uc758 \uc815\ud655\ud788 \ub3d9\uc2dc\uc5d0 \uc2e4\ud589\ub418\ub294 \uc21c\uac04\uc744 \ub9cc\ub4e4\uc5b4\ub0b4\uae30 \uc704\ud574 \ub808\uc774\uc2a4\ucee8\ub514\uc158\uc744 \ubc1c\uc0dd\uc2dc\ud0a8\ub2e4.<\/li>\n<\/ol>\n