CVE-2018-4241
HIGHApple tvOS < 11.4 - Kernel Buffer Overflow in mptcp_usr_connectx
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2018-4241. PoCs published by Google Security Research, 0neday.
AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in the mptcp_usr_connectx function in MacOS and iOS 11, where improper handling of sockaddrs (non-AF_INET/AF_INET6) leads to a controlled pointer overwrite and potential kernel memory corruption. The PoC triggers the issue by manipulating sa_len to overwrite the mpte_itfinfo field, resulting in a kfree of a controlled pointer when the socket is closed.
Description
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "Kernel" component. A buffer overflow in mptcp_usr_connectx allows attackers to execute arbitrary code in a privileged context via a crafted app.
Exploits (2)
This exploit targets a buffer overflow vulnerability in the mptcp_usr_connectx function in MacOS and iOS 11, where improper handling of sockaddrs (non-AF_INET/AF_INET6) leads to a controlled pointer overwrite and potential kernel memory corruption. The PoC triggers the issue by manipulating sa_len to overwrite the mpte_itfinfo field, resulting in a kfree of a controlled pointer when the socket is closed.
This is a working exploit PoC for CVE-2018-4241, targeting a memory corruption vulnerability in the mptcp_usr_connectx function on iOS 11.0-11.3.1. The exploit leverages a heap overflow to achieve arbitrary kernel memory read/write, leading to local privilege escalation.
References (7)
Scores
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H