vendor:
Mac OS X
by:
Google Security Research
7,8
CVSS
HIGH
OS X and iOS kernel UaF/double free
416
CWE
Product Name: Mac OS X
Affected Version From: OS X 10.11.1
Affected Version To: OS X 10.11.1
Patch Exists: YES
Related CWE: N/A
CPE: o:apple:mac_os_x:10.11.1
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: OS X
2015
OS X and iOS kernel UaF/double free due to lack of locking in IOHDIXControllUserClient::clientClose
This vulnerability is due to the lack of locking in IOHDIXControllUserClient::clientClose. At offset +0x200 the user client has a vfs_context_t (struct vfs_context*) which is passed to vfs_context_rele() at offset +0x69. This should be protected by a lock, but it isn't. This means that if two threads call clientClose() at the same time, they can both release the same vfs_context_t, leading to a use-after-free or a double-free.
Mitigation:
Apply the patch provided by the vendor.
