CVE-2016-1793

HIGH

Apple OS X < 10.11.5 - Remote Code Execution or Denial of Service via AppleGraphicsDeviceControlClient

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-1793. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages a race condition in AppleGraphicsDeviceControlClient to trigger a NULL pointer dereference in the kernel, allowing arbitrary kernel RIP control by mapping the NULL page in userspace. It targets macOS 10.11.4 via a race between IOServiceClose and an external method call.

Description

AppleGraphicsDeviceControlClient in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · cdososx

https://www.exploit-db.com/exploits/39923

View Code ZIP pw:eip

This exploit leverages a race condition in AppleGraphicsDeviceControlClient to trigger a NULL pointer dereference in the kernel, allowing arbitrary kernel RIP control by mapping the NULL page in userspace. It targets macOS 10.11.4 via a race between IOServiceClose and an external method call.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Racy

Target: Apple macOS 10.11.4 (15E65)

No auth needed

Prerequisites: macOS 10.11.4 with vulnerable AppleGraphicsDeviceControlClient · Ability to execute code on the target system

MITRE ATT&CK