Vulners
Lucene search
MacOS Kernel < 10.12.2 / iOS < 10.2 - ipc_port_t Reference Count Leak Due to Incorrect externa
| Reporter | Title | Published | Views | Family All 28 |
|---|---|---|---|---|
 | iOS / macOS - task_swap_mach_voucher() Use-After-Free Exploit | 25 Jan 201900:00 | – | zdt |
 | Mac OS X 10.x < 10.12.2 Multiple Vulnerabilities | 16 Dec 201600:00 | – | nessus |
| Apple iOS < 10.2 Multiple Vulnerabilities | 5 Jan 201700:00 | – | nessus |
| Apple TV < 10.1 Multiple Vulnerabilities | 5 Jan 201700:00 | – | nessus |
| Apple iOS < 10.2 Multiple Vulnerabilities | 14 Dec 201600:00 | – | nessus |
| macOS 10.12.x < 10.12.2 Multiple Vulnerabilities | 16 Dec 201600:00 | – | nessus |
 | About the security content of watchOS 3.1.3 | 23 Jan 201700:00 | – | apple |
| About the security content of iOS 10.2 | 12 Dec 201600:00 | – | apple |
| About the security content of macOS Sierra 10.12.2, Security Update 2016-003 El Capitan, and Security Update 2016-007 Yosemite | 13 Dec 201600:00 | – | apple |
| About the security content of tvOS 10.1 | 12 Dec 201600:00 | – | apple |
10
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=930
IOUserClient subclasses which override IOUserClient::externalMethod need to ensure that if they return
kIOReturnSuccess they actually take ownership of the mach_port_t asyncWakePort if they are called via
IOConnectCallAsyncMethod.
If the userclient code doesn't take ownership of the mach port and returns a success code MIG assumes that
they did take ownership and won't release it's reference on the port. This leads to a reference count leak.
See the previous bug for more in-depth discussion.
This PoC targets IOSurface which was just the first userclient I looked at; I imagine more are vulnerable.
This PoC takes about an hour on 4 core MacBookPro to trigger the kernel UaF.
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40955.zip
# 0day.today [2018-02-19] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
23 Dec 2016 00:00Current
7.3High risk
Vulners AI Score7.3
EPSS0.01352