|
|
OS X exploitable kernel NULL dereference in CoreCaptureResponder due to unchecked return value | |||
| Project Member Reported by ianbeer@google.com, Mar 23 2016 | Back to list | |||
Pretty much all the external methods of CoreCaptureUserClient call CoreCaptureUserClient::stashGet passing an attacker controlled key. If that key isn't in the list of stashed objects then stashGet returns a NULL pointer. No callers actually check the return value though which leads immediately to a call to a virtual method on a NULL pointer. By mapping the NULL page we can get trivial RIP control. Tested on OS X 10.11.4 (15E65) on MacBookAir 5,2
Project Member
Comment 1
by
ianbeer@google.com,
Mar 23 2016
,
May 18 2016
Apple advisory: https://support.apple.com/en-us/HT206567
,
Jun 9 2016
,
Jul 14 2016
I've go through the code, and trying to do some experiment on OS X 10.11. But I got "invalid address" when trying to allocate memory on address 0. How can we mapping the NULL page? May I need some other exploitation?
,
Jul 15 2016
Just got it, i need to complie a 32bit binary:) |
||||
| ► Sign in to add a comment | ||||
