CVE-2017-13868
MEDIUMApple <11.2, <10.13.2, <4.2, <11.2 - Info Disclosure
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2017-13868. PoCs published by Brandon Azad, bazad.
AI-analyzed exploit summary This exploit leverages a kernel heap information leak in macOS High Sierra (CVE-2017-13868) by exploiting a race condition in the `ctl_ctloutput()` function, which fails to check the return value of `sooptcopyin()`. This allows uninitialized kernel heap data to be leaked to user space via a crafted `getsockopt()` call on a kernel control socket.
Description
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
Exploits (2)
This exploit leverages a kernel heap information leak in macOS High Sierra (CVE-2017-13868) by exploiting a race condition in the `ctl_ctloutput()` function, which fails to check the return value of `sooptcopyin()`. This allows uninitialized kernel heap data to be leaked to user space via a crafted `getsockopt()` call on a kernel control socket.
This PoC exploits CVE-2017-13868, a kernel heap information leak in macOS High Sierra 10.13 and iOS 10.1.1, by leveraging a race condition in the `ctl_ctloutput` function to leak uninitialized kernel heap data to user space. The exploit requires root privileges and demonstrates the vulnerability by triggering a race between memory allocation and copy operations.
References (10)
Scores
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N