CVE-2020-27950
MEDIUM KEViPadOS < 14.2 - Memory Disclosure via Mach Message Trailers
Title source: llmExploitation Summary
CVE-2020-27950 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021. EIP tracks 3 public exploits from researchers including synacktiv, lyonzon2, X1cT34m.
AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2020-27950, which leverages a use-after-free vulnerability in the XNU kernel's Mach message handling to leak kernel memory. The exploit demonstrates memory corruption by manipulating kalloc.1024 allocations and reading back leaked port addresses.
Description
A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. A malicious application may be able to disclose kernel memory.
Exploits (3)
This repository contains a proof-of-concept exploit for CVE-2020-27950, which leverages a use-after-free vulnerability in the XNU kernel's Mach message handling to leak kernel memory. The exploit demonstrates memory corruption by manipulating kalloc.1024 allocations and reading back leaked port addresses.
This PoC exploits CVE-2020-27950, a WebKit vulnerability, using Metasploit's `webkit_backdrop_filter_blur` module to crash browsers via a crafted webpage. It integrates ngrok for public URL generation to facilitate testing.
The repository contains functional exploit code for CVE-2020-27950, demonstrating a port pointer leak and a simple PoC for a use-after-free vulnerability in the XNU kernel's Mach message handling. The code manipulates kalloc.1024 allocations to leak kernel memory addresses.
References (11)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N