📄 macOS Sonoma 14.5 Denial of Service

macOS Sonoma version 14.5 has a vulnerability in the AV1Syntax::ParseHeader function that can allow for a kernel crash. ============================================================================================================================================= | Title : macOS Sonoma 14.5 potenti...

Simple macOS kernel extension fuzzing in userspace with IDA and TinyInst

Posted by Ivan Fratric, Google Project Zero Recently, one of the projects I was involved in had to do with video decoding on Apple platforms, specifically AV1 decoding. On Apple devices that support AV1 video format starting from Apple A17 iOS / M3 macOS, decoding is done in hardware. However,...

libaom:av1_dec_fuzzer: Segv on unknown address in od_ec_dec_init

Detailed Report: https://oss-fuzz.com/testcase?key=5067078385074176 Project: libaom Fuzzing Engine: afl Fuzz Target: av1decfuzzer Job Type: aflasanlibaom Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: odecdecinit aomreaderinit av1decodetgtilesandwrapup Sanitize...

libaom:av1_dec_fuzzer: Use-of-uninitialized-value in od_ec_decode_bool_q15

Detailed Report: https://oss-fuzz.com/testcase?key=5446697209626624 Project: libaom Fuzzing Engine: libFuzzer Fuzz Target: av1decfuzzer Job Type: libfuzzermsanlibaom Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: odecdecodeboolq15 av1readcoeffstxb...