CVE-2006-4392
Mac OS X 10.4-10.4.7 - Local Privilege Escalation via Mach Exception Port Manipulation
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-4392. PoCs published by xmath, Kevin Finisterre.
AI-analyzed exploit summary This exploit leverages a Mach exception handling vulnerability in Mac OS X 10.4.6 and older to regain control of a setuid process via an inherited exception handler. It uses RLIMIT_STACK to trigger a segfault after exec(), allowing arbitrary code execution.
Description
The Mach kernel, as used in operating systems including (1) Mac OS X 10.4 through 10.4.7 and (2) OpenStep before 4.2, allows local users to gain privileges via a parent process that forces an exception in a setuid child and uses Mach exception ports to modify the child's thread context and task address space in a way that causes the child to call a parent-controlled function.
Exploits (2)
This exploit leverages a Mach exception handling vulnerability in Mac OS X 10.4.6 and older to regain control of a setuid process via an inherited exception handler. It uses RLIMIT_STACK to trigger a segfault after exec(), allowing arbitrary code execution.
This exploit leverages a Mach exception handling vulnerability in Mac OS X 10.4.6 and earlier to execute arbitrary code with elevated privileges. It installs an exception handler, forks a child process, and triggers a segfault via RLIMIT_STACK to regain control of the task port.