www.trendmicro.com
Open in
urlscan Pro
23.32.242.31
Public Scan
URL:
https://www.trendmicro.com/en_us/research/21/f/CVE-2021-30724_CVMServer_Vulnerability_in_macOS_and_iOS.html
Submission: On October 04 via api from DE — Scanned from DE
Submission: On October 04 via api from DE — Scanned from DE
Form analysis 1 forms found in the DOM
<form class="main-menu-search" aria-label="Search Trend Micro" data-equally-id="equally_ai___dvhcq">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" autocomplete="off" aria-label="search">
</td>
</tr>
</tbody>
</table>
</div>
</form>Text Content
Business
search close
* Solutions
* By Challenge
* By Challenge
* By Challenge
Learn more
* Understand, Prioritize & Mitigate Risks
* Understand, Prioritize & Mitigate Risks
Improve your risk posture with attack surface management
Learn more
* Protect Cloud-Native Apps
* Protect Cloud-Native Apps
Security that enables business outcomes
Learn more
* Protect Your Hybrid World
* Protect Your Hybrid, Multi-Cloud World
Gain visibility and meet business needs with security
Learn more
* Securing Your Borderless Workforce
* Securing Your Borderless Workforce
Connect with confidence from anywhere, on any device
Learn more
* Eliminate Network Blind Spots
* Eliminate Network Blind Spots
Secure users and key operations throughout your environment
Learn more
* See More. Respond Faster.
* See More. Respond Faster.
Move faster than your adversaries with powerful purpose-built XDR,
attack surface risk management, and zero trust capabilities
Learn more
* Extend Your Team
* Extend Your Team. Respond to Threats Agilely
Maximize effectiveness with proactive risk reduction and managed
services
Learn more
* Operationalizing Zero Trust
* Operationalizing Zero Trust
Understand your attack surface, assess your risk in real time, and
adjust policies across network, workloads, and devices from a single
console
Learn more
* By Role
* By Role
* By Role
Learn more
* CISO
* CISO
Drive business value with measurable cybersecurity outcomes
Learn more
* SOC Manager
* SOC Manager
See more, act faster
Learn more
* Infrastructure Manager
* Infrastructure Manager
Evolve your security to mitigate threats quickly and effectively
Learn more
* Cloud Builder and Developer
* Cloud Builder and Developer
Ensure code runs only as intended
Learn more
* Cloud Security Ops
* Cloud Security Ops
Gain visibility and control with security designed for cloud
environments
Learn more
* By Industry
* By Industry
* By Industry
Learn more
* Healthcare
* Healthcare
Protect patient data, devices, and networks while meeting regulations
Learn more
* Manufacturing
* Manufacturing
Protecting your factory environments – from traditional devices to
state-of-the-art infrastructures
Learn more
* Oil & Gas
* Oil & Gas
ICS/OT Security for the oil and gas utility industry
Learn more
* Electric Utility
* Electric Utility
ICS/OT Security for the electric utility
Learn more
* Federal
* Federal
Learn more
* Automotive
* Automotive
Learn more
* 5G Networks
* 5G Networks
Learn more
* Platform
* Vision One Platform
* Trend Vision One
Our Unified Platform
Bridge threat protection and cyber risk management
Learn more
* Attack Surface Management
* Attack Surface Management
Operationalize a zero trust strategy
Learn more
* XDR (Extended Detection & Response)
* XDR (Extended Detection & Response)
Stop adversaries faster with a broader perspective and better context to
hunt, detect, investigate, and respond to threats from a single platform
Learn more
* Endpoint Security
* Endpoint Security
* Endpoint Security Overview
Defend the endpoint through every stage of an attack
Learn more
* Workload Security
* Workload Security
Optimized prevention, detection, and response for endpoints, servers,
and cloud workloads
Learn more
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Cloud Security
* Cloud Security
* Trend Vision One™
Cloud Security Overview
The most trusted cloud security platform for developers, security
teams, and businesses
Learn more
* Cloud Security Posture Management
* Cloud Security Posture Management
Leverage complete visibility and rapid remediation
Learn more
* Container Security
* Container Security
Simplify security for your cloud-native applications with advanced
container image scanning, policy-based admission control, and container
runtime protection
Learn more
* File Storage Security
* File Storage Security
Security for cloud file/object storage services leveraging cloud-native
application architectures
Learn more
* Network Security
* Network Security
Advanced cloud-native network security detection, protection, and cyber
threat disruption for your single and multi-cloud environments.
Learn more
* Open Source Security
* Open Source Security
Visibility and monitoring of open source vulnerabilities for SecOps
Learn more
* Cloud Visibility
* Cloud Visibility
As your organization continues to move data and apps to the cloud and
transform your IT infrastructure, mitigating risk without slowing down
the business is critical.
Learn more
* Network Security
* Network Security
* Network Security Overview
Expand the power of XDR with network detection and response
Learn more
* Network Intrusion Prevention (IPS)
* Network Intrusion Prevention (IPS)
Protect against known, unknown, and undisclosed vulnerabilities in your
network
Learn more
* Breach Detection System (BDS)
* Breach Detection System (BDS)
Detect and respond to targeted attacks moving inbound, outbound, and
laterally
Learn more
* Secure Service Edge (SSE)
* Secure Service Edge (SSE)
Redefine trust and secure digital transformation with continuous risk
assessments
Learn more
* Industrial Network Security
* Industrial Network Security
Learn more
* Email Security
* Email Security
Stop phishing, malware, ransomware, fraud, and targeted attacks from
infiltrating your enterprise
Learn more
* Mobile Security
* Mobile Security
On-premises and cloud protection against malware, malicious applications,
and other mobile threats
Learn more
* Threat Intelligence
* Threat Intelligence
Keep ahead of the latest threats and protect your critical data with
ongoing threat prevention and analysis
Learn more
* Small & Midsized Business Security
* Small & Midsized Business Security
Stop threats with comprehensive, set-it-and-forget-it protection
Learn more
* All Products, Services and Trials
* All Products, Services and Trials
Learn more
* Research
* Research
* Research
* Research
Learn more
* About Our Research
* About Our Research
Learn more
* Research, News, and Perspectives
* Research, News, and Perspectives
Learn more
* Research and Analysis
* Research and Analysis
Learn more
* Blog
* Blog
Learn more
* Security News
* Security News
Learn more
* Zero Day Initiatives (ZDI)
* Zero Day Initiatives (ZDI)
Learn more
* Services
* Our Services
* Our Services
* Our Services
Learn more
* Service Packages
* Service Packages
Augment security teams with 24/7/365 managed detection, response, and
support
Learn more
* Managed XDR
* Managed XDR
Augment threat detection with expertly managed detection and response
(MDR) for email, endpoints, servers, cloud workloads, and networks
Learn more
* Incident Response
* Incident Response
* Incident Response
Our trusted experts are on call whether you're experiencing a breach
or looking to proactively improve your IR plans
Learn more
* Insurance Carriers and Law Firms
* Insurance Carriers and Law Firms
Stop breaches with the best response and detection technology on the
market and reduce clients’ downtime and claim costs
Learn more
* Support Services
* Support Services
Learn more
* Partners
* Partner Program
* Partner Program
* Partner Program Overview
Grow your business and protect your customers with the best-in-class
complete, multilayered security
Learn more
* Managed Security Service Provider
* Managed Security Service Provider
Deliver modern security operations services with our industry-leading
XDR
Learn more
* Managed Service Provider
* Managed Service Provider
Partner with a leading expert in cybersecurity, leverage proven
solutions designed for MSPs
Learn more
* Cloud Service Provider
* Cloud Service Provider
Add market-leading security to your cloud service offerings – no matter
which platform you use
Learn more
* Professional Services
* Professional Services
Increase revenue with industry-leading security
Learn more
* Resellers
* Resellers
Discover the possibilities
Learn more
* Marketplace
* Marketplace
Learn more
* System Integrators
* System Integrators
Learn more
* Alliance Partners
* Alliance Partners
* Alliance Overview
We work with the best to help you optimize performance and value
Learn more
* Technology Alliance Partners
* Technology Alliance Partners
Learn more
* Our Alliance Partners
* Our Alliance Partners
Learn more
* Partner Tools
* Partner Tools
* Partner Tools
Learn more
* Partner Login
* Partner Login
Login
* Education and Certification
* Education and Certification
Learn more
* Partner Successes
* Partner Successes
Learn more
* Distributors
* Distributors
Learn more
* Find a Partner
* Find a Partner
Learn more
* Company
* Why Trend Micro
* Why Trend Micro
* Why Trend Micro
Learn more
* The Trend Micro Difference
* The Trend Micro Difference
Learn more
* Customer Success Stories
* Customer Success Stories
Learn more
* The Human Connection
* The Human Connection
Learn more
* Industry Accolades
* Industry Accolades
Learn more
* Strategic Alliances
* Strategic Alliances
Learn more
* About Us
* About Us
* About Us
Learn more
* Trust Center
* Trust Center
Learn more
* History
* History
Learn more
* Diversity, Equity and Inclusion
* Diversity, Equity and Inclusion
Learn more
* Corporate Social Responsibility
* Corporate Social Responsibility
Learn more
* Leadership
* Leadership
Learn more
* Security Experts
* Security Experts
Learn more
* Internet Safety and Cybersecurity Education
* Internet Safety and Cybersecurity Education
Learn more
* Legal
* Legal
Learn more
* Investors
* Investors
Learn more
* Connect with Us
* Connect with Us
* Connect with Us
Learn more
* Newsroom
* Newsroom
Learn more
* Events
* Events
Learn more
* Careers
* Careers
Learn more
* Webinars
* Webinars
Learn more
Back
Back
Back
Back
* Free Trials
* Contact Us
Looking for home solutions?
Under Attack?
0
Back
Folio (0)
Support
* Business Support Portal
* Virus and Threat Help
* Renewals and Registration
* Education and Certification
* Contact Support
* Find a Support Partner
Resources
* Cyber Risk Index/Assessment
* CISO Resource Center
* DevOps Resource Center
* What Is?
* Threat Encyclopedia
* Cloud Health Assessment
* Cyber Insurance
* Glossary of Terms
* Webinars
Log In
* Support
* Partner Portal
* Cloud One
* Product Activation and Management
* Referral Affililate
Back
arrow_back
search
close
Content has been added to your Folio
Go to Folio (0) close
Exploits & Vulnerabilities
CVE-2021-30724: CVMSERVER VULNERABILITY IN MACOS AND IOS
We discovered a vulnerability in macOS, iOS, and iPadOS rooted in the CVMServer.
The vulnerability, labeled CVE-2021-30724, can allow threat actors to escalate
their privilege if exploited.
By: Mickey Jin June 03, 2021 Read time: 4 min (1133 words)
Save to Folio
Subscribe
--------------------------------------------------------------------------------
We discovered a vulnerability in macOS rooted in the Core Virtual Machine Server
(CVMServer). The vulnerability, labeled CVE-2021-30724, is triggered by an
integer overflow leading to an out-of-bounds memory access, from which point
privilege escalation can be attained. It affects devices running older versions
of macOS Big Sur 11.4, iOS 14.6, and iPadOS 14.6.
This issue has already been fixed by Apple at the time of writing. This blog
entry details where we discovered the vulnerability and how it can be triggered.
THE CVMSERVER
The CVMServer is an XPC service and is a system daemon that runs in root to
handle XPC requests. XPC is a framework implemented by Apple and is a low-level
communication mechanism between different processes. Client processes send XPC
request messages through an XPC-related API. Then the server will receive the
message and handle it. One of its most frequently used clients are written in
the OpenCL framework. The main logic it uses is a big switch case to dispatch
many kinds of XPC messages. Figure 1 shows an example of the CVMServer’s switch
case logic.
Figure 1. Switch case logic of the CVMServer dispatching many kinds of XPC
messages
THE VULNERABILITY
The issue exists in the XPC request message handler, more specifically in the
processing of a request (case msgType=18) to build an element using the OpenCL
source code.
Figure 2. Case 18 logic of the CVMServer logic where the vulnerability exists
Figure 2 shows the logic in which the vulnerability exists. As shown in the
image, item[3*count] is the mapped length, returned from xpc_shmem_map (seen in
line 134). Meanwhile, beginOffset is controllable from the XPC request message
(seen in line 135). If the value of item[3*count] is less than that of
beginOffset, then according to the logic, the value of remainLen will be an
integer overflow. This will lead to the check in line 144 being bypassed.
Therefore, the vulnerability can be triggered by specifying
item[count]=accessDataLen to a large integer (seen from line 136 to 137), which
will lead to out of bounds memory access and potential privilege escalation if
exploited.
TRIGGERING THE VULNERABILITY
Figure 1 also shows that the flag context->attached is set inside case 4. This
means to send the request (case msgType=18), the CVMS service must be attached
and XPC request msgType=4 is sent. In turn, to send the XPC requests to the
service, a connection must first be established. By searching cross-references
to the API call _xpc_connection_create_mach_service we were able to get the
service name “com.apple.cvmsServ,” and thus establish a connection.
> int64_t cvms_connection_create(xpc_connection_t *conn) {
>
> int64_t error = 528;
>
> xpc_connection_t client =
> xpc_connection_create_mach_service("com.apple.cvmsServ", NULL, 2);
>
> xpc_connection_set_event_handler(client, ^(xpc_object_t event) {});
>
> xpc_connection_resume(client);
>
> xpc_object_t req = xpc_dictionary_create(NULL, NULL, 0);
>
> xpc_dictionary_set_int64 (req, "message", 1);
>
> xpc_object_t res = xpc_connection_send_message_with_reply_sync(client, req);
>
> printf("response: %s\n", xpc_copy_description(res));
>
> if (xpc_get_type(res) == XPC_TYPE_DICTIONARY) {
>
> error = xpc_dictionary_get_int64(res, "error");
>
> if (!error) {
>
> *conn = client;
>
> }
>
> }
>
> return error;
>
> }
After doing so, we attached the service, with the arguments fetched through
debugging.
> int64_t cvms_service_attach(xpc_connection_t conn) {
>
> int64_t error = 528;
>
> xpc_object_t req = xpc_dictionary_create(NULL, NULL, 0);
>
> xpc_dictionary_set_int64 (req, "message", 4);
>
> xpc_dictionary_set_string(req, "framework_name", "OpenCL");
>
> xpc_dictionary_set_string(req, "bitcode_name", "");
>
> xpc_dictionary_set_string(req, "plugin_name",
> "/System/Library/Frameworks/OpenGL.framework/Libraries/libGLVMPlugin.dylib");
>
> struct AttachArgs {
>
> int64_t a1;
>
> int64_t a2;
>
> } args = {0, 0x0000211000000009};//M1 Mac use 0x000021100000000a
>
> xpc_dictionary_set_data(req, "args", &args, sizeof(args));
>
> xpc_object_t res = xpc_connection_send_message_with_reply_sync(conn, req);
>
> printf("response: %s\n", xpc_copy_description(res));
>
> if (xpc_get_type(res) == XPC_TYPE_DICTIONARY) {
>
> error = xpc_dictionary_get_int64(res, "error");
>
> if (!error) {
>
> int64_t pool_index = xpc_dictionary_get_int64(res, "pool_index");
>
> printf("pool_index: %lld\n", pool_index);
>
> }
>
> }
>
> return error;
>
> }
After attaching the CVMS service and sending XPC request msgType=4 we can now
send the request (case msgType=18) where the vulnerability is found. To better
understand how this vulnerability is triggered, we explain the XPC message
structure shown in Figure 2.
From line 97 to 105, we can see that request[“source”] is an XPC array, which
stores the list of source code data. At line 108, 32 bytes (4 pointer size) is
allocated for each array item.
Figure 3. Layout of decompiled source_data_array
The do-while loop from line 111 to 156 fills the array item with each data
source value. The type of the data source value is either xpc_type_data or
xpc_type_shmem. The logic here states that the address range
[accessBeginPointer, accessBeginPointer+accessDataLength) must be a subset of
the range [mappedBaseAddress, mappedBaseAddress+mappedLength). The logic,
therefore, checks if the value of accessDataLength is less than that of the
mappedLength minus the beginOffset value. This check must be bypassed to trigger
the vulnerability. Luckily for this analysis, all these values are controlled
from the XPC request messages.
At line 138, there is a check for the beginOffset value where it must be less
than one page or 4K in size. However, mappedLength returned from xpc_shmem_map
is always set to the 4K size. This makes it seem hard to trigger the
vulnerability. But examining the implementation of the function xpc_shmem_map
revealed the trick — patching the mappedLength to any small value, which in our
case was one, at the field offset 0x20 of the xpc_xshmem object.
With this method, we were able to bypass the check on line 144 through integer
overflow, and then trigger a memory access out-of-memory by a specified large
number. The trigger code could look something like the one shown in Figure 5.
The full POC can be found in GitHub.
Figure 4. MappedLength can be patched to a small value at the field offset 0x20
Figure 5. Code showing the mapped length patched to one to bypass the check in
the server.
THE IMPLEMENTED FIX
Apple has already made a fix for CVE-2021-30724. The solution was simple: Add a
check to avoid the integer overflow (line 178 in Figure 6). As an aside, we
found that the binary CVMCompiler has the same issue, which has also been fixed
using this method used for CVE-2021-30724.
Figure 6. Code showing the solution for CVE-2021-30724 at line 178
While this solution works for similar cases, another perhaps more comprehensive
tactic would be to put a check inside the API implementation xpc_shmem_map, as
this is the root cause of the vulnerability. It is possible to grep the
xpc_shmem_map API call from all system native Mach-O to hunt similar issues. In
fact, this was the method we used to discover the same problem in CVMCompiler.
SECURITY RECOMMENDATIONS
The vulnerability is moderately difficult to trigger, but not impossible, as we
had demonstrated here. If CVE-2021-30724 is left unpatched, an attacker can
elevate his privileges by exploiting the vulnerability. Users should keep their
devices up-to-date to receive the latest patches. Apple has released the
security updates that address this issue, which are macOS Big Sur 11.4, iOS
14.6, and iPadOS 14.6. Users can also consider solutions such as the Trend Micro
Antivirus for Mac and Trend Micro Protection Suites that help detect and block
attacks that exploit such flaws.
Tags
Articles, News, Reports | Exploits & Vulnerabilities | Research
AUTHORS
* Mickey Jin
Threats Analyst
Contact Us
Subscribe
RELATED ARTICLES
* Revisiting 16shop Phishing Kit, Trend-Interpol Partnership
* APT34 Deploys Phishing Attack With New Malware
* Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral
Movement
See all articles
Try our services free for 30 days
* Start your free trial today
*
*
*
*
*
RESOURCES
* Blog
* Newsroom
* Threat Reports
* DevOps Resource Center
* CISO Resource Center
* Find a Partner
SUPPORT
* Business Support Portal
* Contact Us
* Downloads
* Free Trials
*
*
ABOUT TREND
* About Us
* Careers
* Locations
* Upcoming Events
* Trust Center
*
Select a country / region
United States expand_more
close
THE AMERICAS
* United States
* Brasil
* Canada
* México
MIDDLE EAST & AFRICA
* South Africa
* Middle East and North Africa
EUROPE
* België (Belgium)
* Česká Republika
* Danmark
* Deutschland, Österreich Schweiz
* España
* France
* Ireland
* Italia
* Nederland
* Norge (Norway)
* Polska (Poland)
* Suomi (Finland)
* Sverige (Sweden)
* Türkiye (Turkey)
* United Kingdom
ASIA & PACIFIC
* Australia
* Центральная Азия (Central Asia)
* Hong Kong (English)
* 香港 (中文) (Hong Kong)
* भारत गणराज्य (India)
* Indonesia
* 日本 (Japan)
* 대한민국 (South Korea)
* Malaysia
* Монголия (Mongolia) and рузия (Georgia)
* New Zealand
* Philippines
* Singapore
* 台灣 (Taiwan)
* ประเทศไทย (Thailand)
* Việt Nam
Privacy | Legal | Accessibility | Site map
Copyright ©2023 Trend Micro Incorporated. All rights reserved
sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk
This website uses cookies for website functionality, traffic analytics,
personalization, social media functionality and advertising. Our Cookie Notice
provides more information and explains how to amend your cookie settings.Learn
more
Cookies Settings Accept
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
Sumo