CVE-2014-1372
published 2014-07-01CVE-2014-1372: Graphics Driver in Apple OS X before 10.9.4 does not properly restrict read operations during processing of an unspecified system call, which allows local…
PriorityP416medium4.9CVSS 2.0
AVLACLAuNCCINAN
EPSS
0.47%
38.4th percentile
Graphics Driver in Apple OS X before 10.9.4 does not properly restrict read operations during processing of an unspecified system call, which allows local users to obtain sensitive information from kernel memory and bypass the ASLR protection mechanism via a crafted call.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | <= 10.9.3 | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cmq7-qqv3-qrgw: Graphics Driver in Apple OS X before 10
ghsa_unreviewed·2022-05-17
CVE-2014-1372 [MEDIUM] GHSA-cmq7-qqv3-qrgw: Graphics Driver in Apple OS X before 10
Graphics Driver in Apple OS X before 10.9.4 does not properly restrict read operations during processing of an unspecified system call, which allows local users to obtain sensitive information from kernel memory and bypass the ASLR protection mechanism via a crafted call.
Project0
pwn4fun Spring 2014 - Safari - Part II - Project Zero
project_zero·2014-11-01
CVE-2014-1372 pwn4fun Spring 2014 - Safari - Part II - Project Zero
Posted by Ian Beer
##
TL;DR
An OS X GPU driver trusted a user-supplied kernel C++ object pointer and called a virtual function. The IOKit registry contained kernel pointers which were used defeat kASLR. A kernel ROP payload ran Calculator.app as root using a convenient kernel API.
##
Overview of part I
We finished part I with the ability to load our own native library into the Safari renderer process on OS X by exploiting an integer truncation bug in the Safari javascript engine. Here in part II we’ll take a look at how sandboxing works on OS X, revise some OS X fundamentals and then exploit two kernel bugs to launch Calculator.app running as root from inside the Safari sandbox.
##
Safari process model
Safari’s sandboxing model is based on privilege separation. It uses the WebK
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.htmlhttp://secunia.com/advisories/59475http://support.apple.com/kb/HT6296http://www.securitytracker.com/id/1030505https://code.google.com/p/google-security-research/issues/detail?id=18http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.htmlhttp://secunia.com/advisories/59475http://support.apple.com/kb/HT6296http://www.securitytracker.com/id/1030505https://code.google.com/p/google-security-research/issues/detail?id=18
2014-07-01
Published