Exploitation Summary
EIP tracks 2 public exploits for CVE-2017-13861.
PoCs published by Google Security Research, saelo, niklasb, Ian Beer, siguza, including Metasploit module exploits/apple_ios/browser/webkit_createthis.
AI-analyzed exploit summary This exploit leverages a reference counting bug in IOSurfaceRootUserClient (CVE-2017-13861) to achieve local privilege escalation (LPE) on iOS and macOS. The vulnerability arises from incorrect MIG lifetime management, leading to a use-after-free condition.
Description
An issue was discovered in certain Apple products. iOS before 11.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "IOSurface" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Exploits (2)
This exploit leverages a reference counting bug in IOSurfaceRootUserClient (CVE-2017-13861) to achieve local privilege escalation (LPE) on iOS and macOS. The vulnerability arises from incorrect MIG lifetime management, leading to a use-after-free condition.
This Metasploit module exploits a type confusion vulnerability in WebKit (CVE-2018-4233) to achieve arbitrary memory read/write, followed by a kernel exploit (CVE-2017-13861) to gain root privileges on iOS. It chains these exploits to bypass sandboxing and execute a Meterpreter payload.
References (8)
Scores
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H