Recently, Apple pushed two security fixes for issues in the way GarageBand and Logic Pro X parsed MIDI (musical instrument digital interface) data. GarageBand is free and is available in the default OS X image. Logic Pro X can be purchased in the App Store:
MIDI
Available for: macOS Big Sur 11.5 and later
Impact: Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution
Description: A memory initialization issue was addressed with improved memory handling.
CVE-2022-22657: Brandon Perry of Atredis Partners
MIDI
Available for: macOS Big Sur 11.5 and later
Impact: Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2022-22664: Brandon Perry of Atredis PartnersTHE BACKGROUND
I do a lot with music and audio/visual-related work outside of my work at Atredis, but this is the first time my hobby in recording and music directly influenced my bug hunting.
While looking into MIDI support on Linux, I noticed the application Timidity was often used to play MIDI files. Unfortunately, Timidity has been unsupported for a very long time and no official source code repository seemed to exist. However, while playing with it, I got the idea to fuzz Timidity, but not because I wanted to look for any bugs in Timidity itself.
Setting up Timidity to fuzz was simple with AFL (American Fuzzy Lop). Firstly, compile with instrumentation, and you are good to go.
Fuzzing Timidity with AFL
After a few days, I wasn’t finding any more new paths. In the end, I had 100,000 weird MIDI files.
GARAGEBAND AND LOGIC
GarageBand comes installed by default on the latest Macs and is primarily how you play MIDIs on OS X. There are also iPad apps for both GarageBand and Logic Pro X. On OS X, by double-clicking on a MIDI, it will open in GarageBand by default. To me, this implied that I could pass a MIDI to the GarageBand binary as an argument on the command-line.
cd /Applications/GarageBand.app/Content/MacOS/
./GarageBand ~/test.midiSure enough, this opened GarageBand and the MIDI. To start running GarageBand against all of my MIDIs, I hacked up this quick bash script.
for i in `ls /Users/bperry/midis/`
do
./GarageBand /Users/bperry/midis/$i&
sleep 15
killall -9 GarageBand
doneLuckily, GarageBand supports logging it’s crash reports with the OS X crash handler, so you get nice crash reports like this.
Time Awake Since Boot: 550000 seconds
System Integrity Protection: enabled
Crashed Thread: 0
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000
Exception Note: EXC_CORPSE_NOTIFY
Termination Signal: Segmentation fault: 11
Termination Reason: Namespace SIGNAL, Code 0xb
Terminating Process: exc handler [86400]
VM Regions Near 0:
-->
__TEXT 1062db000-1082af000 [ 31.8M] r-x/r-x SM=COW /Applications/Logic Pro X.app/Contents/MacOS/Logic Pro X
Application Specific Information:
Squire | 9822ba165c8200ad3eea20c1d3f8a51ff3c7a5c38397f17d396e73f464c81ef7 | 285921cb956a827f4eba8133900ad6876a990855 | 2021-11-05_15:18:01
Thread 0 Crashed:
0 id:000053,src:000000,op:havoc,rep:8,+cov.mid 0x0000000106e98f6d 0x1062db000 + 12312429
1 id:000053,src:000000,op:havoc,rep:8,+cov.mid 0x0000000106e9a988 0x1062db000 + 12319112
2 id:000053,src:000000,op:havoc,rep:8,+cov.mid 0x00000001076757bc 0x1062db000 + 20555708
3 com.apple.AppKit 0x00007fff23307f18 -[NSDocumentController(NSDeprecated) openDocumentWithContentsOfURL:display:error:] + 808
4 id:000053,src:000000,op:havoc,rep:8,+cov.mid 0x0000000107b9022c 0x1062db000 + 25907756
5 com.apple.Foundation 0x00007fff212e449f __NSBLOCKOPERATION_IS_CALLING_OUT_TO_A_BLOCK__ + 7
6 com.apple.Foundation 0x00007fff212e4397 -[NSBlockOperation main] + 98
7 com.apple.Foundation 0x00007fff212e432a __NSOPERATION_IS_INVOKING_MAIN__ + 17THE TAKEAWAY
In the end, I gave Apple 38 crashes. They determined 2 were security-relevant. These issues affected Logic Pro X and GarageBand on OSX and iOS and were fixed in version 10.4.6 of GarageBand and 10.7.3 in Logic Pro X. All of the files I provided Apple are available in the following Github repository.
https://github.com/brandonprry/apple_midi
When approaching opaque targets, it may be better to fuzz a faster and easier alternative and use the generated corpus against the more difficult target. It’s not a perfect technique, but can still be fruitful.
TIMELINE
-
Dec 2 2021 – Reported issues to Apple
-
Dec 3 2021 – Response from support confirming receipt
-
Jan 4 2022 – Atredis requests update
-
Jan 10 2022 – Atredis requests update
-
Jan 17 2022 – Apple responds with update
-
Feb 7 2022 – Atredis requests update
-
Feb 14 2022 – Atredis requests update
-
Feb 17 2022 – Apple responds with update. Parties agree to hold details until patch.
-
Mar 8 2022 – Apple requests credit details
-
Mar 8 2022 – Atredis confirms credit details
-
Mar 14 2022 – Details released and patches available.
