CVE-2017-13855
MEDIUMApple <11.2, <10.13.2, <4.2, <11.2 - Info Disclosure
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2017-13855. PoCs published by Google Security Research.
AI-analyzed exploit summary This exploit triggers a type confusion vulnerability in macOS by calling getsockopt with SO_NECP_ATTRIBUTES on a UNIX domain socket, leading to out-of-bounds memory access and potential kernel memory disclosure.
Description
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app that triggers type confusion.
Exploits (1)
This exploit triggers a type confusion vulnerability in macOS by calling getsockopt with SO_NECP_ATTRIBUTES on a UNIX domain socket, leading to out-of-bounds memory access and potential kernel memory disclosure.
References (9)
Scores
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N