Apple iOSmacOS - Kernel Memory Corruption due to Integer Overflow in IOHIDResourceQueue::enqueueReport

Apple iOSmacOS - Kernel Memory Corruption due to Integer Overflow in IOHIDResourceQueue::enqueueReport / IOHIDResourceQueue inherits from IOSharedDataQueue and adds its own ::enqueueReport method, which seems to be mostly copy-pasted from IOSharedDataQueue and IODataQueue's ::enqueue methods. I...

Deja-XNU

Posted by Ian Beer, Google Project Zero This blog post revisits an old bug found by Pangu Team and combines it with a new, albeit very similar issue I recently found to try to build a "perfect" exploit for iOS 7.1.2. State of the art An idea I've wanted to play with for a while is to revisit old...

CVE-2014-4389

CVE-2014-4389 corresponds to an IODataQueue/IOSharedDataQueue integer overflow in IOKit that could let a crafted API argument overflow queue bounds and corrupt kernel memory, enabling arbitrary code execution with system privileges on affected iOS 7.x/Apple TV 6.x/7.x era devices. Connected mater...