Log in or Sign up

BENVENUTO SU CONSOLE TRIBE

Benvenuto, stai navigando nella nostra community come ospite

Avere un account su Console Tribe ti permetterà di creare e partecipare alle discussioni e al mercatino, organizzare tornei e partite online, iniziare conversazioni personali con gli altri giocatori del forum e di utilizzare tutte le funzioni di questo sito.

Registra il tuo account in meno di 5 secondi, se vuoi puoi sfruttare i login social via Facebook, Google Plus o Twitter.

REGISTRAZIONE Dal Sito 1 Dal Sito 2 Dal Sito 3 Dal Sito 4 Dal Sito 5

Codice Unsigned su Kernel Xbox360 4532 e 4548

Discussion in 'Console News, Articoli e Recensioni' started by Ivan, Feb 28, 2007.

Page 1 of 2

Ivan Administrator

Joined:

Dec 9, 2002

Messages:

17,496

Likes Received:

33

Trophy Points:

1,407

Location:

H3||

Stando a quanto riportato sul noto sito di Security Focus, ben due versioni di kernel di Xbox360 (4532 e 4548) erano soggette ad un bug che permetteva di fatto l'esecuzione di qualsiasi codice non firmato, un po' come avviene sulle Xbox modificate.
L'autore, che resta anonimo, ha segnalato da tempo la cosa a Microsoft che successivamente ad una dimostrazione dal vivo ha provveduto, nell'arco di 6 giorni, a rilasciare il Kernel non exploitabile (4552).

Xbox 360 Hypervisor Privilege Escalation Vulnerability

Release Date:
February 28, 2007

Author:
Anonymous Hacker

Timeline:
Oct 31, 2006 - release of 4532 kernel, which is the first version
containing the bug
Nov 16, 2006 - proof of concept completed; unsigned code running in
hypervisor context
Nov 30, 2006 - release of 4548 kernel, bug still not fixed
Dec 15, 2006 - first attempt to contact vendor to report bug
Dec 30, 2006 - public demonstration
Jan 03, 2007 - vendor contact established, full details disclosed
Jan 09, 2007 - vendor releases patch
Feb 28, 2007 - full public release
Patch Development Time (In Days): 6

Severity:
Critical (Unsigned Code Execution in Hypervisor Mode)

Vendor:
Microsoft

Systems Affected:
All Xbox 360 systems with a kernel version of 4532 (released Oct 31,
2006) and 4548 (released Nov 30, 2006). Versions prior to 4532 are not
affected. Bug was fixed in version 4552 (released Jan 09, 2007 - not a
Patch Tuesday).

Overview:
We have discovered a vulnerability in the Xbox 360 hypervisor that allows
privilege escalation into hypervisor mode. Together with a method to
inject data into non-privileged memory areas, this vulnerability allows
an attacker with physical access to an Xbox 360 to run arbitrary code
such as alternative operating systems with full privileges and full
hardware access.

Technical details:
The Xbox 360 security system is designed around a hypervisor concept. All
games and other applications, which must be cryptographically signed with
Microsoft's private key, run in non-privileged mode, while only a small
hypervisor runs in privileged ("hypervisor") mode. The hypervisor
controls access to memory and provides encryption and decryption
services.

The policy implemented in the hypervisor forces all executable code to be
read-only and encrypted. Therefore, unprivileged code cannot change
executable code. A physical memory attack could modify code; however,
code memory is encrypted with a unique per-session key, making meaningful
modification of code memory in a broadly distributable fashion difficult.
In addition, the stack and heap are always marked as non-executable, and
therefore data loaded there can never be jumped to by unpriviledged code.

Unprivileged code interacts with the hypervisor via the "sc" ("syscall")
instruction, which causes the machine to enter hypervisor mode. The
vulnerability is a result of incomplete checking of the parameters passed
to the syscall dispatcher, as illustrated below.

Preconditions (registers set by unpriviledged code):

%r0 syscall no.
%r3-%r12 syscall arguments

Priviledged code:

13D8: cmplwi %r0, 0x61
13DC: bge illegal_syscall
...
13F0: rldicr %r1, %r0, 2, 61
13F4: lwz %r4, syscall_table(%r1)
13F8: mtlr %r4
...
1414: blrl

The problem is that the "cmplwi" instruction compares only the lower 32
bits of the given syscall number; the upper 32 bits are ignored. The
"rldicr" instruction, however, operates on the complete 64 bit register
value.

The syscall handler address is fetched from the syscall handler offset
table at 0x00000000.00001F68+%r0*4. Setting the upper 32 bits of %r0 to
something other than 0 will change the upper 30 bits of the address used
for the syscall handler offset table lookup. We will now explain how the
Xbox 360 security architecture interprets and aliases these upper bits.

When processing the syscall, the processor is running in "hypervisor real
mode", with the MMU switched off. However, when accessing memory
locations with the MSB cleared, an additional offset, the Hypervisor Real
Mode Offset (HRMO), will be applied to all memory addresses.

Due to the Xbox 360 security architecture, main memory is aliased to
different addresses with different properties, in order to conditionally
enable the security features (encryption and hashing). The hypervisor
sets the value of the HRMO special register so that the hypervisor code,
including the syscall jump table, resides in memory which is hashed as
well as encrypted, even when using zero-based addresses.

When accessing memory locations with the most significant address bit
set, the HRMOR setting is not applied. Due to the bug in the "cmplwi"
instruction, setting the corresponding bits in %r0 on syscall entry
allows setting the MSB, thereby overriding the HRMOR setting and tricking
the address lookup of the syscall handler to fetch from memory without
any security features.

With the syscall handler offset table aliased to unencrypted memory, the
syscall handler table can now be modified to direct the hypervisor to
jump to any location in code space that is designated for the hypervisor.
In the proof of concept implementation, a jump to existing hypervisor
code is used with a pre-loaded register value as a trampoline to force
the ultimate execution path to an arbitrary, unencrypted and executable
location in memory.

Proof of Concept Details:
As it is not possible to directly overwrite even non-priviledged code,
existing code needs to be tricked into calling the hypervisor syscall
with the desired register set. This can be done by setting up a stack
frame and forcing a context switch to this stack frame. The bug can be
exploited using the following series of physical memory writes:

Setup context switch to stack @80130AF0:

00130390: 00000000 00000000 00000000 FDFFD7FF MSR mask
00130360: 00000000 80130AF0 00000000 00000000 New stack pointer

Setup stack:

00130BD0: 00000000 80070190 00000000 00000000 NIP to context restore
00130C90: 00000000 00000000 80070228 80070228 NIP, LR after context
restore point to syscall
instruction in kernel
00130CA0: 00000000 00009030 00000000 00000000 MSR

00130B40: 20000000 00000046 00000000 80130af0 r0 = syscall nr
r1 = stack
00130B60: 80000000 address1 r4 = address to jump to

00002080: 00000350 points to mtctr %r4,
bctr in hypervisor code

Code to be executed should be placed at "address1", which can be an
arbitrary unused memory address.

Example code to output '!' to the on board serial port:

1:
li %r3, '!'
bl putc
b 1b

putc:
lis %r4, 0x8000
ori %r4, %r4, 0x200
rldicr %r4, %r4, 32, 31
oris %r4, %r4, 0xea00
slwi %r3, %r3, 24
stw %r3, 0x1014(%r4)
1:
lwz %r3, 0x1018(%r4)
rlwinm. %r3, %r3, 0, 6, 6
beq 1b
blr

Vendor Status:
Vendor was notified anonymously, and after cordial discussions a patch
was promptly released.

Recommendation:
Remove R6T3.
Click to expand...

Ivan, Feb 28, 2007

#1
rayheart Tribe Member

Joined:

Sep 5, 2005

Messages:

419

Likes Received:

0

Trophy Points:

16

che schifo, si è venduto!

rayheart, Feb 28, 2007

#2
Marcus1977 Tribe Member

Joined:

Feb 12, 2007

Messages:

1,824

Likes Received:

0

Trophy Points:

36

Location:

Palermo

non ci sono piu' gli hacker di una volta...

Marcus1977, Feb 28, 2007

#3
rayheart Tribe Member

Joined:

Sep 5, 2005

Messages:

419

Likes Received:

0

Trophy Points:

16

a questo punto ci dobbiamo aspettare un downgrade

rayheart, Feb 28, 2007

#4
Difio Tribe Member

Joined:

Aug 27, 2006

Messages:

23,626

Likes Received:

238

Trophy Points:

63

Location:

Arezzo, Italy, Italy

per quale motivo avrà segnalato il baco all microsoft???????????
avevamo una speranza per gli homebrew!!!!!!!!!!!!!!!1

Difio, Feb 28, 2007

#5
rayheart Tribe Member

Joined:

Sep 5, 2005

Messages:

419

Likes Received:

0

Trophy Points:

16

Difio said: ↑

per quale motivo avrà segnalato il baco all microsoft???????????
avevamo una speranza per gli homebrew!!!!!!!!!!!!!!!1
Click to expand...

cash!

rayheart, Feb 28, 2007

#6
Marcus1977 Tribe Member

Joined:

Feb 12, 2007

Messages:

1,824

Likes Received:

0

Trophy Points:

36

Location:

Palermo

Difio said: ↑

per quale motivo avrà segnalato il baco all microsoft???????????
Click to expand...

Marcus1977, Feb 28, 2007

#7
LorD_ Tribe Member

Joined:

Jan 9, 2008

Messages:

1,086

Likes Received:

0

Trophy Points:

36

"anonimo"
forse a noi...

LorD_

LorD_, Feb 28, 2007

#8
malstrom Tribe Member

Joined:

Mar 2, 2007

Messages:

137

Likes Received:

0

Trophy Points:

16

questo hacker "anonimo" ci ha visto bene, sicuramente ora lo zio bill lo sfamerà per parecchi anni! Comunque sia è un peccato che il bug sia stato risolto, sarebbe stato interessante vedere l'evolversi della cosa!!

malstrom, Feb 28, 2007

#9
Marcus1977 Tribe Member

Joined:

Feb 12, 2007

Messages:

1,824

Likes Received:

0

Trophy Points:

36

Location:

Palermo

malstrom said: ↑

questo hacker "anonimo" ci ha visto bene, sicuramente ora lo zio bill lo sfamerà per parecchi anni! Comunque sia è un peccato che il bug sia stato risolto, sarebbe stato interessante vedere l'evolversi della cosa!!
Click to expand...

chi non avrebbe accettato una cospicua somma di denaro?...comunque..morto un bug se ne trova un altro...

Marcus1977, Feb 28, 2007

#10
Lorenz Puppous User

Joined:

Jan 25, 2005

Messages:

17,699

Likes Received:

37

Trophy Points:

1,408

Location:

Cazzo vuoi?

Una volta scoperto (mi sembra logico che l'avrebbero comunque scoperto), lo avrebbero comunque segato subito con l'upgrade obbligatorio contenuto nei giochi o via Live. E addio homebrews.

Lorenz, Feb 28, 2007

#11
rayheart Tribe Member

Joined:

Sep 5, 2005

Messages:

419

Likes Received:

0

Trophy Points:

16

Lorenz said: ↑

Una volta scoperto (mi sembra logico che l'avrebbero comunque scoperto), lo avrebbero comunque segato subito con l'upgrade obbligatorio contenuto nei giochi o via Live. E addio homebrews.
Click to expand...

eheheh si sarebbe trovata qualche soluzione alternativa (psp)

rayheart, Feb 28, 2007

#12
Lorenz Puppous User

Joined:

Jan 25, 2005

Messages:

17,699

Likes Received:

37

Trophy Points:

1,408

Location:

Cazzo vuoi?

Addio Live in ogni caso. E visto che si gioca sia offline sia in Live anche con la mod del firmware, io, come moltissimi altri, avrei comunque lasciato linux e compagnia bella a chi agogna l'homebrew come fosse il messia.

Lorenz, Feb 28, 2007

#13
Swrdmstr Tribe Member

Joined:

Feb 21, 2007

Messages:

6,986

Likes Received:

1

Trophy Points:

257

Location:

Bussy Saint Georges

PSN Tag:

AF_UomoSenzaNome

sono con te... preferisco farmi le mie belle partitelle in live piuttosto che utilizzare il notepad o il browser per internet...

Swrdmstr, Feb 28, 2007

#14
t3o Tribe Member

Joined:

Aug 27, 2003

Messages:

13,251

Likes Received:

2

Trophy Points:

697

rayheart said: ↑

eheheh si sarebbe trovata qualche soluzione alternativa (psp)
Click to expand...

con la differenza che la psp non ha aggiornamenti obbligatori via live...

t3o, Feb 28, 2007

#15
Justme La Suocera

Joined:

Dec 31, 2005

Messages:

24,425

Likes Received:

53

Trophy Points:

2,508

Location:

Milano

rayheart said: ↑

a questo punto ci dobbiamo aspettare un downgrade
Click to expand...

il downgrade dall'ultima versione del kernel non è possibile... ora si è capito il perchè

Justme, Feb 28, 2007

#16
Ivan Administrator

Joined:

Dec 9, 2002

Messages:

17,496

Likes Received:

33

Trophy Points:

1,407

Location:

H3||

t3o said: ↑

con la differenza che la psp non ha aggiornamenti obbligatori via live...
Click to expand...

la differenza è che la Xbox360 non è SONY...e qua ho detto tutto

Ivan, Feb 28, 2007

#17
imported_Minotauro Tribe Newbie

Joined:

Jan 3, 2005

Messages:

33

Likes Received:

0

Trophy Points:

6

Ragazzi dato che nn ne capisco molto, questo bug che è stato svelato, cosa comporta?
In che consiste?

imported_Minotauro, Feb 28, 2007

#18
T19 Tribe Newbie

Joined:

Dec 26, 2007

Messages:

14

Likes Received:

0

Trophy Points:

1

se implementassero qualche funzione aggiuntiva forse non si cercherebbe a tutti i costi di espugnarla,per esempio il fatto di non potere utilizzare i miei divx da hd esterno è una vergognoso.

T19, Feb 28, 2007

#19
Dante1991 Tribe Member

Joined:

Jan 1, 2006

Messages:

5,432

Likes Received:

1

Trophy Points:

247

Location:

Salerno

t3o said: ↑

con la differenza che la psp non ha aggiornamenti obbligatori via live...
Click to expand...

...ma hai aggiornamenti obbligatori per giocare a qualsiasi gioco....

Dante1991, Feb 28, 2007

#20

(You must log in or sign up to reply here.)

Page 1 of 2