Apple macOS/iOS – ‘CAMediaTimingFunctionBuiltin’ NSKeyedArchiver Memory Corruption Due to Lack of Bounds Checking

• Exploit Database
• 17 阅读

• 作者： Google Security Research
  日期： 2017-05-23
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/42052/

• Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1175
  
  CAMediaTimingFunctionBuiltin is a class in QuartzCore. Its initWithCoder: method
  reads an Int "index" then passes that to builtin_function
  
  mov ebx, edi <-- controlled unsigned int
  mov r14d, ebx
  lea r15, __ZL9functions_0 ; functions
  mov rax, [r15+r14*8]
  
  if rax is non-null it's returned as an objective-c object pointer and the objective-c retain
  selector is sent to it.
  
  Serialized poc in attached file with an index of 12345678.
  
  tested on MacOS 10.12.3 (16D32)
  
  
  Proof of Concept:
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42052.zip