|
|
OS X exploitable kernel NULL pointer dereference in nvCommandQueue::GetHandleIndex in GeForce.kext | |||
| Project Member Reported by ianbeer@google.com, Mar 25 2016 | Back to list | |||
The method nvCommandQueue::GetHandleIndex doesn't check whether this+0x5b8 is non-null before using it. We can race a call to this method this with another thread calling IOServiceClose to get a NULL pointer there. By mapping the NULL page in userspace this gives us trivial kernel RIP control as the code makes a virtual call on a NULL object pointer. tested on OS X 10.11.4 (15E65) MacBookPro 10,1
Project Member
Comment 1
by
ianbeer@google.com,
Mar 25 2016
,
May 18 2016
Apple advisory: https://support.apple.com/en-us/HT206567
,
Jun 9 2016
|
||||
| ► Sign in to add a comment | ||||
