CVE-2016-7617

This PoC exploits a type confusion vulnerability in macOS IOKit by manipulating the IOUserClientClass property of AppleBroadcomBluetoothHostController, allowing an unprivileged user to attach an arbitrary IOUserClient (e.g., IGAccelSharedUserClient) to the service, leading to invalid virtual calls and potential kernel code execution.

physmem is a physical memory inspection tool and local privilege escalation exploit targeting macOS up to 10.12.1. It exploits CVE-2016-1825 or CVE-2016-7617, both logic bugs in IOKit registry properties, allowing arbitrary physical memory read/write and root shell execution.