ctl_ctloutput-leak

ctlctloutput-leak macOS High Sierra 10.13 中的 ctlctloutput 函数忽略了 sooptcopyin 调用的返回值，这打开了一个竞态窗口，可将未初始化的内核堆数据泄漏到用户空间。ctlctloutput-leak 是一个概念验证漏洞利用，试图触发此信息泄漏。利用需要 root 权限。 已确认该漏洞利用在 macOS High Sierra 10.13.1 Beta 17B25c 和 iOS 10.1.1 14B100（通过 machportal）上有效。 漏洞：CVE-2017-13868 以下是 macOS High Sierra...

Apple macOS HighSierra 10.13 - ctl_ctloutput-leak Information Leak Exploit

Exploit for macOS platform in category local exploits / ctlctloutput-leak.c Brandon Azad CVE-2017-13868 While looking through the source code of XNU version 4570.1.46, I noticed that the function ctlctloutput in the file bsd/kern/kerncontrol.c does not check the return value of sooptcopyin, which...

Apple macOS High Sierra 10.13 - ctl_ctloutput-leak Information Leak

Apple macOS High Sierra 10.13 - ctlctloutput-leak Information Leak / ctlctloutput-leak.c Brandon Azad CVE-2017-13868 While looking through the source code of XNU version 4570.1.46, I noticed that the function ctlctloutput in the file bsd/kern/kerncontrol.c does not check the return value of...