I wrote a little program to run over every IOKit IOService userclient type from 1 to 100 and just call IOConnectMapMemory for all the memory type values from 1 to 1000.

Calling IOConnectMapMemory on userclient type 2 of "IntelAccelerator" with memory type 3 hits an exploitable kernel NULL pointer dereference calling a virtual function on an object at 0x0.

Attached PoC exploits this to get root.

(The cleanup ROP uses a hardcoded offset for 10.9.5.)
 

ig_2_3_exploit.c 10.2 KB Download