Exploitation Summary
EIP tracks 1 public exploit for CVE-2016-1846. PoCs published by Google Security Research.
AI-analyzed exploit summary This exploit leverages a race condition in the nvCommandQueue::GetHandleIndex method in GeForce.kext to achieve a NULL pointer dereference, leading to kernel RIP control. It maps the NULL page in userspace and races IOServiceClose with an IOKit call to trigger the vulnerability.
Description
The nvCommandQueue::GetHandleIndex method in the NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference and memory corruption) via a crafted app.
Exploits (1)
This exploit leverages a race condition in the nvCommandQueue::GetHandleIndex method in GeForce.kext to achieve a NULL pointer dereference, leading to kernel RIP control. It maps the NULL page in userspace and races IOServiceClose with an IOKit call to trigger the vulnerability.
References (7)
Scores
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H