iDefense Security Advisory 05.14.09: Apple Mac OS X xnu Kernel workqueue_additem/workqueue_removeitem Index Validation Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDefense Security Advisory 05.12.09 http://labs.idefense.com/intelligence/vulnerabilities/ May 12, 2009 I. BACKGROUND Mac OS X is a computer operating systems available from Apple Inc. OS X is the tenth major version of Apple's operating system for...

Design/Logic Flaw

Array index error in the xnu Mach kernel in Apple Mac OS X 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service system shutdown via unspecified vectors related to workqueues...

CVE-2008-1517

Array index error in the xnu Mach kernel in Apple Mac OS X 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service system shutdown via unspecified vectors related to workqueues...

CVE-2008-1517

CVE-2008-1517 affects Mac OS X 10.5.x (xnu/Mach kernel) where an unchecked index in the workqueue handling can be exploited locally to obtain privileges or trigger a denial of service (system shutdown). The issue is described as an index validation vulnerability in the kernel’s workqueues, with t...

Race condition

Race condition in the HFS vfs sysctl interface in XNU 1228.8.20 and earlier on Apple Mac OS X 10.5.6 and earlier allows local users to cause a denial of service kernel memory corruption by simultaneously executing the same HFSSETPKGEXTENSIONS code path in multiple threads, which is problematic...

Information disclosure

Multiple memory leaks in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allow local users to cause a denial of service kernel memory consumption via a crafted 1 SYSaddprofil or 2 SYSmacgetfsstat system call...

CVE-2009-1237

Multiple memory leaks in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allow local users to cause a denial of service kernel memory consumption via a crafted 1 SYSaddprofil or 2 SYSmacgetfsstat system call...

Design/Logic Flaw

XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space and the HFS IOCTL handler, which allows local users to overwrite kernel memory and gain privileges by attaching an HFS+ disk image and performing certain steps involving...

CVE-2009-1235

XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space and the HFS IOCTL handler, which allows local users to overwrite kernel memory and gain privileges by attaching an HFS+ disk image and performing certain steps involving...

CVE-2009-1236

Heap-based buffer overflow in the AppleTalk networking stack in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allows remote attackers to cause a denial of service system crash via a ZIP NOTIFY aka ZIPOPNOTIFY packet that overwrites a certain ifPort structure member...

Heap overflow

Heap-based buffer overflow in the AppleTalk networking stack in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allows remote attackers to cause a denial of service system crash via a ZIP NOTIFY aka ZIPOPNOTIFY packet that overwrites a certain ifPort structure member...

CVE-2009-1237

Multiple memory leaks in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allow local users to cause a denial of service kernel memory consumption via a crafted 1 SYSaddprofil or 2 SYSmacgetfsstat system call...

CVE-2009-1238

The CVE relates to a race condition in the HFS vfs sysctl interface of the XNU kernel (affected: older Apple Mac OS X 10.5.6 and earlier; specific build 1228.8.20 and earlier). The flaw arises from lack of mutex locking for an unspecified global variable, allowing local users to trigger kernel me...

CVE-2009-1237

CVE-2009-1237 affects Apple Mac OS X 10.5.6 and earlier, with XNU kernel versions up to 1228.3.13. It describes memory leaks in the kernel (SYS_add_profil and SYS___mac_getfsstat) that can allow local users to cause a denial of service via kernel memory consumption.

CVE-2009-1238

Race condition in the HFS vfs sysctl interface in XNU 1228.8.20 and earlier on Apple Mac OS X 10.5.6 and earlier allows local users to cause a denial of service kernel memory corruption by simultaneously executing the same HFSSETPKGEXTENSIONS code path in multiple threads, which is problematic...

CVE-2009-1235

CVE-2009-1235 affects Apple Mac OS X 10.5.x (XNU kernel)

CVE-2009-1236

Heap-based buffer overflow in the AppleTalk networking stack in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allows remote attackers to cause a denial of service system crash via a ZIP NOTIFY aka ZIPOPNOTIFY packet that overwrites a certain ifPort structure member...

CVE-2009-1235

XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space and the HFS IOCTL handler, which allows local users to overwrite kernel memory and gain privileges by attaching an HFS+ disk image and performing certain steps involving...

Mac OS X xnu <=1228.x (vfssysctl) Local Kernel DoS PoC

No description provided by source. / xnu-vfssysctl-dos.c Copyright c 2008 by [email protected] Apple MACOS X xnu = 1228.x local kernel DoS POC by mu-b - Wed 19 Nov 2008 - Tested on: Apple MACOS X 10.5.5 xnu-1228.8.201/RELEASEI386 - Private Source Code -DO NOT DISTRIBUTE -...

Mac OS X xnu <= 1228.3.13 (profil) Kernel Memory Leak/DoS PoC

No description provided by source. / xnu-profil-leak.c Copyright c 2008 by [email protected] Apple MACOS X xnu = 1228.3.13 local kernel memory leak/DoS POC by mu-b - Sat 16 Feb 2008 - Tested on: Apple MACOS X 10.5.1 xnu-1228.0.21/RELEASEI386 Apple MACOS X 10.5.2 xnu-1228.3.131/RELEASEI386 -...