CVE-2016-7661
HIGHiPhone OS < 10.2 and macOS < 10.12.2 - Local Privilege Escalation via Power Management Mach Port Name References
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2016-7661. PoCs published by Google Security Research.
AI-analyzed exploit summary This exploit leverages a Mach port deallocation vulnerability in powerd (CVE-2016-7661) by spoofing a MACH_NOTIFY_DEAD_NAME message to force the privileged process to drop a reference on an attacker-controlled Mach port, potentially leading to privilege escalation.
Description
An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. The issue involves the "Power Management" component. It allows local users to gain privileges via unspecified vectors related to Mach port name references.
Exploits (2)
This exploit leverages a Mach port deallocation vulnerability in powerd (CVE-2016-7661) by spoofing a MACH_NOTIFY_DEAD_NAME message to force the privileged process to drop a reference on an attacker-controlled Mach port, potentially leading to privilege escalation.
This exploit targets a race condition in the `set_dp_control_port` MIG method in macOS/iOS kernels, allowing root-to-kernel privilege escalation. The PoC demonstrates a race condition leading to a use-after-free or reference count manipulation, enabling arbitrary kernel memory manipulation.
References (6)
Scores
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H