search

codenote / google-security-research

Automatically exported from code.google.com/p/google-security-research
0 stars 0 forks source link

OS X IOKit kernel code execution due to lack of bounds checking in IOAccelDisplayPipeTransaction2::set_plane_gamma_table #33

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
IOAccelDisplayPipe2::transaction_set_plane_gamma_table fails to verify the 
second dword of IOAccelDisplayPipeGammaTableArgs which can be controlled by 
calling the external method with selector 5 of IOAccelDisplayPipeUserClient2.

This unchecked dword is passed to 
IOAccelDisplayPipeTransaction2::set_plane_gamma_table where it is used as an 
index to read a pointer to a c++ object from an array. By specifying a large 
index this will read a c++ object pointer out-of-bounds. The code then calls a 
virtual function on this object.

Impact:
This userclient can be instantiated in the chrome GPU process sandbox and the 
safari renderer sandbox.

Original issue reported on code.google.com by ianb...@google.com on 16 Jun 2014 at 1:55

Attachments:

GoogleCodeExporter commented 9 years ago

Original comment by ianb...@google.com on 16 Jun 2014 at 2:00

GoogleCodeExporter commented 9 years ago

Original comment by ianb...@google.com on 16 Jun 2014 at 2:00

GoogleCodeExporter commented 9 years ago

Original comment by ianb...@google.com on 22 Aug 2014 at 9:36

GoogleCodeExporter commented 9 years ago 
Deadline exceeded - automatically derestricting

Original comment by ianb...@google.com on 14 Sep 2014 at 12:19

GoogleCodeExporter commented 9 years ago 
http://support.apple.com/kb/HT6443

Original comment by cev...@google.com on 23 Sep 2014 at 9:28