CVE-2018-4243
HIGHiPhone OS < 11.4 - Remote Code Execution via getvolattrlist Buffer Overflow
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2018-4243. PoCs published by Google Security Research, Jailbreaks.
AI-analyzed exploit summary This exploit demonstrates a kernel heap overflow in macOS/iOS due to insufficient buffer size validation in the `getvolattrlist` function. By supplying a small buffer size while requesting `ATTR_CMN_RETURNED_ATTRS`, the kernel copies data beyond the allocated buffer, leading to a heap-based overflow.
Description
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "Kernel" component. A buffer overflow in getvolattrlist allows attackers to execute arbitrary code in a privileged context via a crafted app.
Exploits (2)
This exploit demonstrates a kernel heap overflow in macOS/iOS due to insufficient buffer size validation in the `getvolattrlist` function. By supplying a small buffer size while requesting `ATTR_CMN_RETURNED_ATTRS`, the kernel copies data beyond the allocated buffer, leading to a heap-based overflow.
This is a working exploit for CVE-2018-4243, an iOS kernel vulnerability in the `getvolattrlist` function that allows a NULL pointer write off the end of a kalloc.16 allocation. The exploit targets `struct ipc_port` to achieve kernel read/write access on iOS 11.0-11.3.1.
References (7)
Scores
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H