CVE-2013-3953

The machportspaceinfo function in osfmk/ipc/machdebug.c in the XNU kernel in Apple Mac OS X 10.8.x does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted call...

CVE-2013-3952

The CVE affects Apple Mac OS X 10.8.x, specifically the XNU kernel’s fill_pipeinfo in bsd/kern/sys_pipe.c. The vulnerability allows local users to defeat KASLR by abusing the PROC_PIDFDPIPEINFO option to the proc_info system call on a kernel pipe handle. Potential impact is exposure of kernel add...

CVE-2013-3949

The CVE-2013-3949 entry concerns the XNU kernel used in Apple Mac OS X 10.8.x. The issue arises in the posix_spawn system call, which does not prevent the use of _POSIX_SPAWN_DISABLE_ASLR and _POSIX_SPAWN_ALLOW_DATA_EXEC flags for setuid/setgid programs. This enables local users to bypass intende...

CVE-2013-3955

The CVE-2013-3955 issue affects Apple iOS XNU kernel (iOS 5.x–6.x up to 6.1.3 on iPad). It stems from get_xattrinfo failing to validate the AppleDouble file header, enabling a local attacker to trigger memory corruption (DoS) or other impact via an invalid AppleDouble file on msdosfs. The vulnera...

CVE-2013-3955

The getxattrinfo function in the XNU kernel in Apple iOS 5.x and 6.x through 6.1.3 on iPad devices does not properly validate the header of an AppleDouble file, which might allow local users to cause a denial of service memory corruption or have unspecified other impact via an invalid file on an...

CVE-2013-3953

CVE-2013-3953 concerns the XNU kernel on macOS, where the mach_port_space_info API in osfmk/ipc/mach_debug.c does not initialize a structure member. This causes information disclosure from kernel heap memory via a crafted call on affected systems (OS X 10.8.x). Connected documents confirm the ker...

CVE-2013-3952

The fillpipeinfo function in bsd/kern/syspipe.c in the XNU kernel in Apple Mac OS X 10.8.x allows local users to defeat the KASLR protection mechanism via the PROCPIDFDPIPEINFO option to the procinfo system call for a kernel pipe handle...

BSD derived RFC3173 IPComp encapsulation will expand arbitrarily nested payload

BSD derived RFC3173 IPComp encapsulation will expand arbitrarily nested payload ------------------------------------------------------------------------------- Gruezi, this document describes CVE-2011-1547. RFC3173 ip payload compression, henceforth ipcomp, is a protocol intended to provide...

Apple Mac OS X IPv6 PIM Denial of Service Vulnerability

This vulnerability allows remote attackers to denial of service the IPv6 stack of an installation of Apple Mac OSX. No authentication or user interaction is required in order to exploit this vulnerability. The specific flaw exists within OSX's IPv6 stack. A NULL pointer dereference vulnerability...

Apple MACOS X xnu <= 1228.9.59 Local Kernel Root Exploit

No description provided by source. / xnu-workq-v2-64.c Copyright c 2008 by [email protected] Apple MACOS X xnu = 1228.9.59 local kernel root exploit by mu-b - Sat 16 Feb 2008 - Tested on: Apple MACOS X 10.5.1 xnu-1228.0.21/RELEASEI386 Apple MACOS X 10.5.2 xnu-1228.3.131/RELEASEI386...

Apple Mac OSX xnu 1228.9.59 - Kernel Privilege Escalation

/ xnu-workq-v2-64.c Copyright c 2008 by Apple MACOS X xnu include include include include include include / profil defines / define PROFILITEMSIZE 64 define PROFILBLKSIZE 65536 define PROFILBLKNUM 84 / workq defines / define WQOPSQUEUEADD 1 define WORKQUEUEPRIOSMIN -2 define WORKQUEUEPRIOSMAX 2 /...

Apple Mac OSX xnu 1228.9.59 - Kernel Privilege Escalation

Apple Mac OSX xnu 1228.9.59 - Kernel Privilege Escalation / xnu-workq-v2-64.c Copyright c 2008 by Apple MACOS X xnu include include include include include include / profil defines / define PROFILITEMSIZE 64 define PROFILBLKSIZE 65536 define PROFILBLKNUM 84 / workq defines / define WQOPSQUEUEADD ...

Apple MACOS X xnu <= 1228.9.59 Local Kernel Root Exploit

Exploit for macOS platform in category local exploits ======================================================== Apple MACOS X xnu Apple MACOS X xnu include include include include include include / profil defines / define PROFILITEMSIZE 64 define PROFILBLKSIZE 65536 define PROFILBLKNUM 84 / workq...

iDefense Security Advisory 05.14.09: Apple Mac OS X xnu Kernel workqueue_additem/workqueue_removeitem Index Validation Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDefense Security Advisory 05.12.09 http://labs.idefense.com/intelligence/vulnerabilities/ May 12, 2009 I. BACKGROUND Mac OS X is a computer operating systems available from Apple Inc. OS X is the tenth major version of Apple's operating system for...

Design/Logic Flaw

Array index error in the xnu Mach kernel in Apple Mac OS X 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service system shutdown via unspecified vectors related to workqueues...

CVE-2008-1517

Array index error in the xnu Mach kernel in Apple Mac OS X 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service system shutdown via unspecified vectors related to workqueues...

CVE-2008-1517

CVE-2008-1517 affects Mac OS X 10.5.x (xnu/Mach kernel) where an unchecked index in the workqueue handling can be exploited locally to obtain privileges or trigger a denial of service (system shutdown). The issue is described as an index validation vulnerability in the kernel’s workqueues, with t...

CVE-2009-1235

XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space and the HFS IOCTL handler, which allows local users to overwrite kernel memory and gain privileges by attaching an HFS+ disk image and performing certain steps involving...

CVE-2009-1237

Multiple memory leaks in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allow local users to cause a denial of service kernel memory consumption via a crafted 1 SYSaddprofil or 2 SYSmacgetfsstat system call...

Design/Logic Flaw

XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space and the HFS IOCTL handler, which allows local users to overwrite kernel memory and gain privileges by attaching an HFS+ disk image and performing certain steps involving...