vendor:
MacOS
by:
Project Zero
7,8
CVSS
HIGH
Off-by-one
190
CWE
Product Name: MacOS
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: MacOS
2018
MacOS kernel memory corruption due to off-by-one in audit_pipe_open
audit_pipe_open is the special file open handler for the auditpipe device (major number 10). There's an off-by-one in the minor number bounds check (u < 0 || u > MAX_AUDIT_PIPES) should be (u < 0 || u >= MAX_AUDIT_PIPES). By setting a small ap_qlimit via the AUDITPIPE_SET_QLIMIT ioctl, the struct audit_pipe* can be read out-of-bounds.
Mitigation:
Ensure that the minor number of an opened device is correctly validated.
