CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
5.1%
A local privilege escalation vulnerability exists in the install helper tool of the Mac OS X version of Pixar Renderman, version 22.2.0. A user with local access can use this vulnerability to read any root file from the file system. An attacker would need local access to the machine to successfully exploit this flaw.
Renderman 22.2.0 for Mac OS X
7.1 - CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CWE-19: Improper Input Validation
Renderman is a rendering application used in animation and film production. It is widely used for advanced rendering and shading in many large-scale environments. When installing the Mac OS X version of the application, a helper tool is installed and launched as root. This service continues to listen even after completing installation. The vulnerability lies in the lack of verification in the Dispatch
function. The caller of this function is not checked, and the function is exposed to any user. The relevant code is shown below.
case 0x101D2: [0]
reply = xpc_dictionary_create_reply(a1[1]);
filepath = xpc_dictionary_get_string(a1[1], "filepath"); [1]
fileoflag = xpc_dictionary_get_int64(a1[1], "fileoflag");
filemode = xpc_dictionary_get_int64(a1[1], "filemode");
syslog(5, "openFile request \"%s\" %d %d", filepath, fileoflag, filemode);
...
v9 = open(filepath, fileoflag, filemode); [2]
The first part of the function, [0], gets the message ID and passes it through a switch statement. If the case is the one shown, this code block is entered. At location [1], command options are parsed directly from the XPC message. These variables are then passed into the function open
, [2], and a file descriptor is returned to the caller. An attacker could use this vulnerability to read any file from the file system, crossing a privilege boundary.
2018-11-28 - Vendor disclosure
2018-12-11 - Vendor patched
2019-01-14 - Public release
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
5.1%