New issue
Advanced search Search tips
Issue 772
Starred by 1 user
Status: Fixed
Owner:
ianbeer@google.com
Closed: May 2016
Cc:
project-...@google.com



Sign in to add a comment
 OS X kernel use-after-free due to bad locking in IOAcceleratorFamily2
Project Member Reported by ianbeer@google.com, Mar 22 2016 Back to list 
In IOAccelContext2::clientMemoryForType the lock_busy/unlock_busy should be extended to cover all the code
setting up shared memory type 2.

At the moment the lock doesn't protect two threads racing where one reaches
the release at +0x56AD (outside the lock) while the other is still using those raw pages via the raw pointer at
IOAccelContext+0x610 inside the locked region.

Tested on OS X 10.11.4 (15E65) on MacBookAir 5,2
ioaccel_mem_uaf.c
3.2 KB View Download
Project Member Comment 1 by ianbeer@google.com, Mar 22 2016
Labels: Id-638103752 Reported-2016-Mar-22
Project Member Comment 2 by ianbeer@google.com, May 18 2016
Labels: Fixed-2016-May-16 CVE-2016-1819
Status: Fixed
Apple advisory: https://support.apple.com/en-us/HT206567
Project Member Comment 3 by ianbeer@google.com, Jun 9 2016
Labels: -Restrict-View-Commit
► Sign in to add a comment