Apple macOS - Disk Arbitration Daemon Race Condition Exploit

Exploit for multiple platform in category local exploits !/bin/bash Sources: https://raw.githubusercontent.com/phoenhex/files/master/pocs/poc-mount.sh https://phoenhex.re/2017-06-09/pwn2own-diskarbitrationd-privesc if ! security authorize system.volume.internal.mount &/dev/null; then echo 2&1...

(Pwn2Own) Apple macOS nsurlstoraged Null Pointer Dereference Denial of Service Vulnerability

This vulnerability allows local attackers to trigger a denial-of-service condition on vulnerable installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

Apple macOS - 'stackshot' Raw Frame Pointers(CVE-2017-2516)

This is an issue that allows unentitled root to read kernel frame pointers, which might be useful in combination with a kernel memory corruption bug. By design, the syscall stacksnapshotwithconfig permits unentitled root to dump information about all user stacks and kernel stacks. While a target...

Apple MacOS NSUnarchiver Heap Corruption(CVE-2017-2523)

Via NSUnarchiver we can read NSBuiltinCharacterSet with a controlled serialized state. It reads a controlled int using decodeValueOfObjCType:"i" then either passes it to CFCharacterSetGetPredefined or uses it directly to manipulate NSBuiltinSetTable. Neither path has any bounds checking and the...

Apple macOS Sierra Speech Framework Sandbox Bypass Vulnerability

Apple macOS is an operating system that runs on Apple's Macintosh line of computers. A sandbox bypass vulnerability exists in Apple macOS Sierra Speech Framework, which can be exploited by remote attackers to build malicious applications with elevated privileges...

Apple macOS Sierra NVIDIA Graphics Driver Memory Corruption Vulnerability

Apple macOS is a set of operating systems that run on Apple's Macintosh line of computers. A memory corruption vulnerability exists in the Apple macOS Sierra NVIDIA graphics driver, which can be exploited by remote attackers to build malicious applications with elevated privileges...

Apple macOS Sierra SQLite SQL Query Memory Corruption Vulnerability (CNVD-2017-08133)

Apple macOS is a set of operating systems that run on Apple's Macintosh line of computers. A memory corruption vulnerability exists in the Apple macOS Sierra SQLite SQL query, which can be exploited by a remote attacker to submit a special WEB page and trick the user into parsing it to execute...

Apple macOS Sierra EAP-TLS Certificate Validation Vulnerability

Apple macOS is an operating system that runs on Apple's Macintosh line of computers. A certificate validation vulnerability exists in Apple macOS EAP-TLS, which can be exploited by remote attackers to bypass security restrictions and obtain sensitive information...

Apple macOS - Local Privilege Escalation Due to Lack of Bounds Checking in HIServices Custom CFObjec

Exploit for macOS platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1219 HIServices.framework is used by a handful of deamons and implements its own CFObject serialization mechanism. The entrypoint to the deserialization code is AXUnserializeCFType...

Apple macOS Sierra Memory Handling Elevation of Privilege Vulnerability

Apple macOS is an operating system that runs on Apple's Macintosh line of computers. The Apple macOS processing suffers from a memory handling elevation of privilege vulnerability that can be exploited by remote attackers to build malicious applications with elevated privileges...

Apple macOS Sierra CoreAnimation Memory Handling Elevation of Privilege Vulnerability

Apple macOS is an operating system that runs on Apple's Macintosh line of computers. Apple macOS CoreAnimation suffers from a memory handling elevation of privilege vulnerability that can be exploited by remote attackers to build malicious applications with elevated privileges...

Apple macOS Sierra IOSurface Elevation of Privilege Vulnerability

Apple macOS is an operating system that runs on Apple's Macintosh line of computers. An elevation of privilege vulnerability exists in Apple macOS Sierra IOSurface, which can be exploited by remote attackers to build malicious applications, elevate privileges, and gain kernel privileges...

Apple macOS Sierra Intel Image Driver Elevation of Privilege Vulnerability

Apple macOS is an operating system that runs on Apple's Macintosh line of computers. An elevation of privilege vulnerability exists in the Apple macOS Sierra Intel Image Driver, which can be exploited by remote attackers to build malicious applications with elevated privileges...

Apple macOS Sierra iBooks elevation of privilege vulnerability (CNVD-2017-10184)

Apple macOS is an operating system that runs on Apple's Macintosh line of computers. An elevation of privilege vulnerability exists in Apple macOS Sierra iBooks, which can be exploited by a remote attacker to build a malicious application that bypasses sandbox restrictions and elevates privileges...

Apple macOS/iOS - 'CAMediaTimingFunctionBuiltin' NSKeyedArchiver Memory Corruption Due to Lack of Bounds Checking

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1175 CAMediaTimingFunctionBuiltin is a class in QuartzCore. Its initWithCoder: method reads an Int "index" then passes that to builtinfunction mov ebx, edi -- controlled unsigned int mov r14d, ebx lea r15, ZL9functions0 ; functions...

Apple macOS/iOS Kernel - Use-After-Free Due to Bad Locking in Unix Domain Socket File Descriptor Externalization

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1123 unpexternalize is responsible for externalizing the file descriptors carried within a unix domain socket message. That means allocating new fd table entries in the receiver and recreating a file which looks looks to userspac...

CVE-2017-2540

An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "WindowServer" component. It allows attackers to bypass intended memory-read restrictions via a crafted app...

Apple macOS - 'stackshot' Raw Frame Pointers

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1164 This is an issue that allows unentitled root to read kernel frame pointers, which might be useful in combination with a kernel memory corruption bug. By design, the syscall stacksnapshotwithconfig permits unentitled root to du...

(Pwn2Own) Apple macOS diskarbitrationd Time-Of-Check/Time-Of-Use Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the diskarbitrationd...

(Pwn2Own) Apple macOS AppleMultitouchDevice Use-After-Free Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the...