Exploitation Summary
EIP tracks 1 public exploit for CVE-2017-2360. PoCs published by Google Security Research.
AI-analyzed exploit summary This PoC exploits a use-after-free vulnerability in the XNU kernel (CVE-2017-2360) by racing task_set_special_port and host_self_trap to trigger a kernel panic or potential privilege escalation. The code demonstrates the lack of proper locking in host_self_trap, leading to a UaF condition.
Description
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. macOS before 10.12.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (use-after-free) via a crafted app.
Exploits (1)
This PoC exploits a use-after-free vulnerability in the XNU kernel (CVE-2017-2360) by racing task_set_special_port and host_self_trap to trigger a kernel panic or potential privilege escalation. The code demonstrates the lack of proper locking in host_self_trap, leading to a UaF condition.
References (8)
Scores
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H