CVE-2016-1744
published 2016-03-24CVE-2016-1744: The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a…
PriorityP344high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
4.16%
89.6th percentile
The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1743.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | <= 10.11.3 | — |
| apple | os_x_el_capitan_v10.11.4_and_security_update_2016-002 | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-whc9-qj3v-8965: The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10
ghsa_unreviewed·2022-05-17·CVSS 7.8
CVE-2016-1743 [HIGH] CWE-119 GHSA-whc9-qj3v-8965: The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10
The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1744.
GHSA
GHSA-v26p-9pmg-6w96: The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10
ghsa_unreviewed·2022-05-17·CVSS 7.8
CVE-2016-1744 [HIGH] CWE-119 GHSA-v26p-9pmg-6w96: The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10
The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1743.
Apple
CVE-2016-1744: OS X El Capitan v10.11.4 and Security Update 2016-002
vendor_apple·CVSS 7.8
CVE-2016-1744 [HIGH] CVE-2016-1744: OS X El Capitan v10.11.4 and Security Update 2016-002
Apple Security Update: About the security content of OS X El Capitan v10.11.4 and Security Update 2016-002
Product: OS X El Capitan v10.11.4 and Security Update 2016-002
CVE: CVE-2016-1744
Component: CVE-ID
No detection rules found.
Exploit-DB
Apple Intel GPU Driver - Use-After-Free/Double-Delete due to bad Locking
exploitdb·2018-10-22·CVSS 7.8
CVE-2016-1744 [HIGH] Apple Intel GPU Driver - Use-After-Free/Double-Delete due to bad Locking
Apple Intel GPU Driver - Use-After-Free/Double-Delete due to bad Locking
---
/*
This PoC file might look familiar; this bug is a trivial variant of CVE-2016-1744 (Apple bug id 635599405.)
That report showed the bug in the unmap_user_memory external methods; a variant also exists
in the map_user_memory external methods.
The intel graphics drivers have their own hash table type IGHashTable which isn't thread-safe.
map_user_memory manipulates an IGHashTable without locking leading to memory issues (eg UaFs and/or double-frees)
tested on MacOS 10.13.5 (17F77) on MacBookPro10,1
*/
//ianbeer
// build: clang -o ig_gl_unmap_racer ig_gl_unmap_racer.c -framework IOKit
#if 0
UaF/Double-delete due to bad locking in Apple Intel GPU driver
This PoC file might look familiar; this bug is a trivi
Exploit-DB
Apple Mac OSX Kernel - Use-After-Free and Double Delete Due to Incorrect Locking in Intel GPU Driver
exploitdb·2016-03-23
CVE-2016-1744 Apple Mac OSX Kernel - Use-After-Free and Double Delete Due to Incorrect Locking in Intel GPU Driver
Apple Mac OSX Kernel - Use-After-Free and Double Delete Due to Incorrect Locking in Intel GPU Driver
---
/*
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=708
The external methods IGAccelGLContext::unmap_user_memory and IGAccelCLContext::unmap_user_memory take
an 8 byte struct input which is a user-space pointer previously passed to the equivilent map_user_memory
method.
The Context objects have inline IGHashTable members which store a mapping between those user pointers
and the IGAccelMemoryMap object pointers to which they refer in the kernel. The unmap_user_memory method
calls in order:
::contains
::get
::remove
on the hashmap *before* taking the context's IOLock. This means we can race two threads and by passing them both a valid
mapped user pointer they will bot
No writeups or analysis indexed.
http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.htmlhttp://www.securitytracker.com/id/1035363https://support.apple.com/HT206167https://www.exploit-db.com/exploits/39616/http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.htmlhttp://www.securitytracker.com/id/1035363https://support.apple.com/HT206167https://www.exploit-db.com/exploits/39616/
2016-03-24
Published