vendor:
OS X
by:
ianbeer
7.5
CVSS
HIGH
NULL pointer dereference
476
CWE
Product Name: OS X
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: NO
Related CWE:
CPE: Unknown
Platforms Tested: OS X 10.11.4 (15E65) MacBookAir 5,2
Unknown
Kernel NULL pointer dereference in IOAudioEngine
The closeClient() method in IOAudioEngineUserClient class sets the audioEngine member pointer to NULL. However, the safeRegisterClientBuffer method uses the audioEngine pointer without checking if it's NULL. This can lead to a NULL pointer dereference vulnerability. By calling the getStreamForID method, which calls a virtual function on a member, an attacker can control the RIP register.
Mitigation:
Unknown