CVE-2015-6996

Apple iOS <9.1, macOS <10.11.1, watchOS <2.0.1 - Remote Code Execution via IOAcceleratorFamily Memory Corruption

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-6996. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages a NULL pointer dereference in IOAccelContext2::connectClient due to unchecked return value of OSMetaClassBase::safeMetaCast, leading to kernel memory corruption and potential privilege escalation on OS X 10.10.5.

Description

IOAcceleratorFamily in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · cdososx

https://www.exploit-db.com/exploits/39380

View Code ZIP pw:eip

This exploit leverages a NULL pointer dereference in IOAccelContext2::connectClient due to unchecked return value of OSMetaClassBase::safeMetaCast, leading to kernel memory corruption and potential privilege escalation on OS X 10.10.5.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: Apple OS X 10.10.5 (IOAcceleratorFamily2)

No auth needed

Prerequisites: Access to a vulnerable macOS system with Intel GPU

MITRE ATT&CK