Re: Apple MacOSX 10.9 Hard Link Memory Corruption

From: Stefan Arentz <stefan@basement.sateh.com>
To: submit@cxsec.org
Cc: bugtraq@securityfocus.com
Subject: Re: Apple MacOSX 10.9 Hard Link Memory Corruption
Date:


On Thu, Nov 07, 2013 at 10:50:59PM +0000, submit@cxsec.org wrote:

> mac-cxs-XK:pochd XK$ gcc -o test test.c
> mac-cxs-XK:pochd XK$ ls
> test    test.c
> mac-cxs-XK:pochd XK$ mkdir DIR1
> mac-cxs-XK:pochd XK$ ./test DIR1 Hardlink1
> link(3) return= -1
> mac-cxs-XK:pochd XK$ mkdir DIR1/DIR2
> mac-cxs-XK:pochd XK$ ./test DIR1/DIR2 Hardlink2
> link(3) return= 0
> mac-cxs-XK:pochd XK$ cd DIR1
> mac-cxs-XK:DIR1 XK$ mkdir DIR2/DIR3
> mac-cxs-XK:DIR1 XK$ ../test DIR2/DIR3 Hardlink3
> link(3) return= 0
> mac-cxs-XK:DIR1 XK$ cd DIR2
> mac-cxs-XK:DIR2 XK$ mkdir DIR3/DIR4
> mac-cxs-XK:DIR2 XK$ ../../test DIR3/DIR4 Hardlink4
> link(3) return= -1

The first failing case is easily explained: directory hard links cannot have the same
parent. This is checked in hfs_link.c[1] in hfs_vnop_link(). Search for the following
comment:

  /* 
         * All directory links must reside in an non-ARCHIVED hierarchy.
    */
        if (v_type == VDIR) {
              /*
          * - Source parent and destination parent cannot match
              * - A link is not permitted in the root directory
          * - Parent of 'pointed at' directory is not the root directory
           * - The 'pointed at' directory (source) is not an ancestor
               *   of the new directory hard link (destination).
          * - No ancestor of the new directory hard link (destination) 
              *   is a directory hard link.
              */
                if ((parentcnid == tdcp->c_fileid) ||
             (tdcp->c_fileid == kHFSRootFolderID) ||
               (parentcnid == kHFSRootFolderID) ||
                cat_check_link_ancestry(hfsmp, tdcp->c_fileid, cp->c_fileid)) {
                      error = EPERM;  /* abide by the rules, you did not */
                      goto out;
          }
  }

Does this also explain the last case?

 S.

[1] http://opensource.apple.com/source/xnu/xnu-2422.1.72/bsd/hfs/hfs_link.c 





Copyright © 1995-2020 LinuxRocket.net. All rights reserved.