CVE-2021-30853

CVE-2021-30853 一个用于测试影响 MacOS 的 CVE-2021-30657 的简单 POC 脚本。 该 CVE 允许绕过 gatekeeper、notarization 和 xprotect 检查。 漏洞详情 当你在可执行 bundle 的主脚本第一行（shebang）中未定义解释器（或指定一个本身是 shell 脚本的解释器）时，就会出现此漏洞。这将导致 xpcproxy 调用 posixspawnp 来启动无解释器的基于脚本的应用程序。这最初会报错（无解释器 → ENOEXEC），但随后 posixspawnp 会“恢复”并（重新）执行该脚本……这次直接通过...

Exploit for Out-of-bounds Write in Apple Macos

CVE-2021-30853 A simple POC script to test for CVE-2021-30657...

FreeBSD : FreeBSD -- posix_spawnp(3) buffer overflow (f8b46415-c264-11ea-8659-901b0ef719ab)

posixspawnp spawns a new thread with a limited stack allocated on the heap before delegating to execvp for the final execution within that thread. execvp would previously make unbounded allocations on the stack, directly proportional to the length of the user-controlled PATH environment variable...

FreeBSD Buffer Overflow Vulnerability (CNVD-2020-38773)

FreeBSD is a type of UNIX operating system, an important branch of Unix that evolved from BSD, 386BSD and 4.4BSD. FreeBSD suffers from a posixspawnp buffer overflow vulnerability. An attacker can exploit this vulnerability to execute arbitrary code...

CVE-2020-7458

In FreeBSD 12.1-STABLE before r362281, 11.4-STABLE before r362281, and 11.4-RELEASE before p1, long values in the user-controlled PATH environment variable cause posixspawnp to write beyond the end of the heap allocated stack possibly leading to arbitrary code execution...

Heap overflow

In FreeBSD 12.1-STABLE before r362281, 11.4-STABLE before r362281, and 11.4-RELEASE before p1, long values in the user-controlled PATH environment variable cause posixspawnp to write beyond the end of the heap allocated stack possibly leading to arbitrary code execution...

CVE-2020-7458

In FreeBSD 12.1-STABLE before r362281, 11.4-STABLE before r362281, and 11.4-RELEASE before p1, long values in the user-controlled PATH environment variable cause posixspawnp to write beyond the end of the heap allocated stack possibly leading to arbitrary code execution...

CVE-2020-7458

CVE-2020-7458 affects FreeBSD: long values in the user-controlled PATH env variable can cause posix_spawnp to write beyond the end of the heap-allocated stack, potentially leading to arbitrary code execution. Affected: FreeBSD 12.1-STABLE before r362281, 11.4-STABLE before r362281, and 11.4-RELEA...

FreeBSD -- posix_spawnp(3) buffer overflow

Problem Description: posixspawnp spawns a new thread with a limited stack allocated on the heap before delegating to execvp for the final execution within that thread. execvp would previously make unbounded allocations on the stack, directly proportional to the length of the user-controlled PATH...

FreeBSD-SA-20:18.posix_spawnp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-20:18.posixspawnp Security Advisory The FreeBSD Project Topic: posixspawnp3 buffer overflow Category: core Module: libc Announced: 2020-07-08 Credits: Andrew...