MacOS/iOS kernel heap overflow in bpf (CVE-2017-2482)

The bpf ioctl BIOCSBLEN allows userspace to set the bpf buffer length: case BIOCSBLEN: / uint / if d-bdbif != 0 error = EINVAL; else uint size; bcopyaddr, &size, sizeof size; if size bpfmaxbufsize size = bpfmaxbufsize; else if size bdbufsize = size; break; d-bdbif is set to the currently attached...

CVE-2017-2482

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the "Kernel" component. A buffer overflow allows attackers to execute arbitrary code in a privileged...

CVE-2017-2482

CVE-2017-2482 is a kernel heap overflow in the BSD Packet Filter (bpf) BIOCSBLEN handling in Apple’s XNU kernel. The vulnerability allows an unauthenticated user-space process to manipulate the kernel heap by changing the bpf buffer size and reattaching interfaces, enabling potential kernel-level...