CVE-2015-7047
watchOS < 2.1 - Local Privilege Escalation via Crafted Mach Message
Title source: llmExploitation Summary
EIP tracks 5 public exploits for CVE-2015-7047. PoCs published by Google Security Research.
AI-analyzed exploit summary This exploit demonstrates a kernel use-after-free (UaF) vulnerability in macOS El Capitan 10.11 due to improper handling of spoofed no-more-senders notifications in the audit session port. The PoC sends a crafted Mach message to trigger the vulnerability.
Description
The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges via a crafted mach message that is misparsed.
Exploits (5)
This exploit demonstrates a kernel use-after-free (UaF) vulnerability in macOS El Capitan 10.11 due to improper handling of spoofed no-more-senders notifications in the audit session port. The PoC sends a crafted Mach message to trigger the vulnerability.
This exploit demonstrates a kernel use-after-free (UaF) vulnerability in IOAccelMemoryInfoUserClient by spoofing 'no more senders' notifications. It triggers the vulnerability by sending crafted Mach messages to the IntelAccelerator service, leading to potential privilege escalation or denial of service.
This exploit demonstrates a kernel use-after-free (UaF) vulnerability in IOAccelDisplayPipeUserClient2 by spoofing 'no more senders' notifications. It triggers the vulnerability by sending crafted Mach messages to the IntelAccelerator service, potentially leading to kernel crashes or arbitrary code execution.
This exploit triggers a race condition in OS X's IOBluetoothHCIController by sending spoofed no-more-senders notifications on two threads, leading to unsafe parallel OSArray manipulation and memory corruption.
This exploit demonstrates a use-after-free vulnerability in the mach voucher subsystem of OS X and iOS. It sends spoofed no-more-senders notifications to a voucher mach port, causing a race condition that leads to a kernel panic due to decrementing the reference count of a freed object.