CVE-2014-1379
published 2014-07-01CVE-2014-1379: Graphics Drivers in Apple OS X before 10.9.4 allows attackers to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via a…
PriorityP434critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
2.24%
81.1th percentile
Graphics Drivers in Apple OS X before 10.9.4 allows attackers to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via a 32-bit executable file for a crafted application.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | <= 10.9.3 | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gpvj-cqx3-m62f: Graphics Drivers in Apple OS X before 10
ghsa_unreviewed·2022-05-17
CVE-2014-1379 [HIGH] GHSA-gpvj-cqx3-m62f: Graphics Drivers in Apple OS X before 10
Graphics Drivers in Apple OS X before 10.9.4 allows attackers to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via a 32-bit executable file for a crafted application.
Project0
pwn4fun Spring 2014 - Safari - Part II - Project Zero
project_zero·2014-11-01
CVE-2014-1372 pwn4fun Spring 2014 - Safari - Part II - Project Zero
Posted by Ian Beer
##
TL;DR
An OS X GPU driver trusted a user-supplied kernel C++ object pointer and called a virtual function. The IOKit registry contained kernel pointers which were used defeat kASLR. A kernel ROP payload ran Calculator.app as root using a convenient kernel API.
##
Overview of part I
We finished part I with the ability to load our own native library into the Safari renderer process on OS X by exploiting an integer truncation bug in the Safari javascript engine. Here in part II we’ll take a look at how sandboxing works on OS X, revise some OS X fundamentals and then exploit two kernel bugs to launch Calculator.app running as root from inside the Safari sandbox.
##
Safari process model
Safari’s sandboxing model is based on privilege separation. It uses the WebK
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.htmlhttp://secunia.com/advisories/59475http://support.apple.com/kb/HT6296http://www.securitytracker.com/id/1030505https://code.google.com/p/google-security-research/issues/detail?id=20http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.htmlhttp://secunia.com/advisories/59475http://support.apple.com/kb/HT6296http://www.securitytracker.com/id/1030505https://code.google.com/p/google-security-research/issues/detail?id=20
2014-07-01
Published