vendor:
MacOS
by:
Jann Horn
7,8
CVSS
HIGH
Out-of-Bounds Read
125
CWE
Product Name: MacOS
Affected Version From: MacOS 10.12.6
Affected Version To: MacOS 10.13.4
Patch Exists: YES
Related CWE: CVE-2017-7163
CPE: o:apple:mac_os_x:10.12.6
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Mac
2017
MacOS kernel memory disclosure due to lack of bounds checking in AppleIntelCapriController::getDisplayPipeCapability
An out-of-bounds read vulnerability exists in the AppleIntelCapriController::getDisplayPipeCapability() function in the MacOS kernel due to lack of bounds checking. An attacker can control a dword from the input buffer which is used to index an array of pointers with no bounds checking. This can be exploited to read kernel memory, allowing an attacker to defeat kernel address space layout randomization (KASLR).
Mitigation:
Apple released a patch to address this vulnerability.