Vulnerabilities > CVE-2016-7633 - Use After Free vulnerability in Apple mac OS X

047910
CVSS 7.2 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
local
low complexity
apple
CWE-416
nessus
exploit available

Summary

An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "Directory Services" component. It allows local users to gain privileges or cause a denial of service (use-after-free) via unspecified vectors.

Vulnerable Configurations

Part Description Count
OS
Apple
102

Common Weakness Enumeration (CWE)

Exploit-Db

  • descriptioniOS/macOS - Kernel Double Free due to IOSurfaceRootUserClient not Respecting MIG Ownership Rules. CVE-2017-13861. Dos exploit for Multiple platform
    fileexploits/multiple/dos/43320.txt
    idEDB-ID:43320
    last seen2017-12-11
    modified2017-12-11
    platformmultiple
    port
    published2017-12-11
    reporterExploit-DB
    sourcehttps://www.exploit-db.com/download/43320/
    titleiOS/macOS - Kernel Double Free due to IOSurfaceRootUserClient not Respecting MIG Ownership Rules
    typedos
  • descriptionMacOS 10.12 - Double vm_deallocate in Userspace MIG Code Use-After-Free. CVE-2016-7633. Dos exploit for macOS platform. Tags: Denial of Service (DoS), Use Af...
    fileexploits/macos/dos/40954.c
    idEDB-ID:40954
    last seen2016-12-22
    modified2016-12-22
    platformmacos
    port
    published2016-12-22
    reporterExploit-DB
    sourcehttps://www.exploit-db.com/download/40954/
    titleMacOS 10.12 - Double vm_deallocate in Userspace MIG Code Use-After-Free
    typedos

Nessus

NASL familyMacOS X Local Security Checks
NASL idMACOS_10_12_2.NASL
descriptionThe remote host is running a version of macOS that is 10.12.x prior to 10.12.2. It is, therefore, affected by multiple vulnerabilities in the following components : - apache_mod_php - AppleGraphicsPowerManagement - Assets - Audio - Bluetooth - CoreCapture - CoreFoundation - CoreGraphics - CoreMedia External Displays - CoreMedia Playback - CoreStorage - CoreText - curl - Directory Services - Disk Images - FontParser - Foundation - Grapher - ICU - ImageIO - Intel Graphics Driver - IOFireWireFamily - IOAcceleratorFamily - IOHIDFamily - IOKit - IOSurface - Kernel - kext tools - libarchive - LibreSSL - OpenLDAP - OpenPAM - OpenSSL - Power Management - Security - syslog - WiFi - xar Note that successful exploitation of the most serious issues can result in arbitrary code execution. Furthermore, CVE-2016-6304, CVE-2016-7596, and CVE-2016-7604 also affect Mac OS X versions 10.10.5 and 10.11.6. However, this plugin does not check those versions.
last seen2020-06-01
modified2020-06-02
plugin id95917
published2016-12-16
reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/95917
titlemacOS 10.12.x < 10.12.2 Multiple Vulnerabilities
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(95917);
  script_version("1.9");
  script_cvs_date("Date: 2020/01/07");

  script_cve_id(
    "CVE-2016-1777",
    "CVE-2016-1823",
    "CVE-2016-4688",
    "CVE-2016-4691",
    "CVE-2016-4693",
    "CVE-2016-5419",
    "CVE-2016-5420",
    "CVE-2016-5421",
    "CVE-2016-6303",
    "CVE-2016-6304",
    "CVE-2016-7141",
    "CVE-2016-7167",
    "CVE-2016-7411",
    "CVE-2016-7412",
    "CVE-2016-7413",
    "CVE-2016-7414",
    "CVE-2016-7416",
    "CVE-2016-7417",
    "CVE-2016-7418",
    "CVE-2016-7588",
    "CVE-2016-7591",
    "CVE-2016-7594",
    "CVE-2016-7595",
    "CVE-2016-7596",
    "CVE-2016-7600",
    "CVE-2016-7602",
    "CVE-2016-7603",
    "CVE-2016-7604",
    "CVE-2016-7605",
    "CVE-2016-7606",
    "CVE-2016-7607",
    "CVE-2016-7608",
    "CVE-2016-7609",
    "CVE-2016-7612",
    "CVE-2016-7615",
    "CVE-2016-7616",
    "CVE-2016-7617",
    "CVE-2016-7618",
    "CVE-2016-7619",
    "CVE-2016-7620",
    "CVE-2016-7621",
    "CVE-2016-7622",
    "CVE-2016-7624",
    "CVE-2016-7625",
    "CVE-2016-7627",
    "CVE-2016-7628",
    "CVE-2016-7629",
    "CVE-2016-7633",
    "CVE-2016-7636",
    "CVE-2016-7637",
    "CVE-2016-7643",
    "CVE-2016-7644",
    "CVE-2016-7655",
    "CVE-2016-7657",
    "CVE-2016-7658",
    "CVE-2016-7659",
    "CVE-2016-7660",
    "CVE-2016-7661",
    "CVE-2016-7662",
    "CVE-2016-7663",
    "CVE-2016-7714",
    "CVE-2016-7742",
    "CVE-2016-7761",
    "CVE-2016-8615",
    "CVE-2016-8616",
    "CVE-2016-8617",
    "CVE-2016-8618",
    "CVE-2016-8619",
    "CVE-2016-8620",
    "CVE-2016-8621",
    "CVE-2016-8622",
    "CVE-2016-8623",
    "CVE-2016-8624",
    "CVE-2016-8625"
  );
  script_bugtraq_id(
    85054,
    90698,
    92292,
    92306,
    92309,
    92754,
    92975,
    92984,
    93004,
    93005,
    93006,
    93007,
    93008,
    93009,
    93011,
    93150,
    94094,
    94096,
    94097,
    94098,
    94100,
    94101,
    94102,
    94103,
    94105,
    94106,
    94107,
    94572,
    94903,
    94904,
    94905,
    94906
  );
  script_xref(name:"APPLE-SA", value:"APPLE-SA-2016-12-13-1");

  script_name(english:"macOS 10.12.x < 10.12.2 Multiple Vulnerabilities");
  script_summary(english:"Checks the version of macOS.");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a macOS update that fixes multiple security
vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote host is running a version of macOS that is 10.12.x prior to
10.12.2. It is, therefore, affected by multiple vulnerabilities in the
following components :

  - apache_mod_php
  - AppleGraphicsPowerManagement
  - Assets
  - Audio
  - Bluetooth
  - CoreCapture
  - CoreFoundation
  - CoreGraphics
  - CoreMedia External Displays
  - CoreMedia Playback
  - CoreStorage
  - CoreText
  - curl
  - Directory Services
  - Disk Images
  - FontParser
  - Foundation
  - Grapher
  - ICU
  - ImageIO
  - Intel Graphics Driver
  - IOFireWireFamily
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - IOSurface
  - Kernel
  - kext tools
  - libarchive
  - LibreSSL
  - OpenLDAP
  - OpenPAM
  - OpenSSL
  - Power Management
  - Security
  - syslog
  - WiFi
  - xar

Note that successful exploitation of the most serious issues can
result in arbitrary code execution.

Furthermore, CVE-2016-6304, CVE-2016-7596, and CVE-2016-7604 also
affect Mac OS X versions 10.10.5 and 10.11.6. However, this plugin
does not check those versions.");
  script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT207423");
  # http://lists.apple.com/archives/security-announce/2016/Dec/msg00003.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?38dabd46");
  script_set_attribute(attribute:"solution", value:
"Upgrade to macOS version 10.12.2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-7644");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/03/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/12/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/12/16");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:macos");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl", "os_fingerprint.nasl");
  script_require_ports("Host/MacOSX/Version", "Host/OS");

  exit(0);
}

include("vcf.inc");
include("vcf_extras_apple.inc");

app_info = vcf::apple::get_macos_info();

vcf::apple::check_macos_restrictions(restrictions:['10.12']);

constraints = [{ "fixed_version" : "10.12.2" }];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);

Seebug

bulletinFamilyexploit
descriptionI have previously detailed the lifetime management paradigms in MIG in the writeups for: CVE-2016-7612 [https://bugs.chromium.org/p/project-zero/issues/detail?id=926] and CVE-2016-7633 [https://bugs.chromium.org/p/project-zero/issues/detail?id=954] If a MIG method returns KERN_SUCCESS it means that the method took ownership of `*all*` the arguments passed to it. If a MIG method returns an error code, then it took ownership of `*none*` of the arguments passed to it. If an IOKit userclient external method takes an async wake mach port argument then the lifetime of the reference on that mach port passed to the external method will be managed by MIG semantics. If the external method returns an error then MIG will assume that the reference was not consumed by the external method and as such the MIG generated coode will drop a reference on the port. IOSurfaceRootUserClient external method 17 (s_set_surface_notify) will drop a reference on the wake_port (via IOUserClient::releaseAsyncReference64) then return an error code if the client has previously registered a port with the same callback function. The external method's error return value propagates via the return value of is_io_connect_async_method back to the MIG generated code which will drop a futher reference on the wake_port when only one was taken. This bug is reachable from the iOS app sandbox as demonstrated by this PoC. Tested on iOS 11.0.3 (11A432) on iPhone 6s (MKQL2CN/A) Tested on MacOS 10.13 (17A365) on MacBookAir5,2 [iosurface_uaf_ios.zip](https://bugs.chromium.org/p/project-zero/issues/attachment?aid=309555) [async_wake_ios.zip ](https://bugs.chromium.org/p/project-zero/issues/attachment?aid=315907)
idSSV:96991
last seen2017-12-25
modified2017-12-15
published2017-12-15
reporterRoot
titleiOS/MacOS kernel double free due to IOSurfaceRootUserClient not respecting MIG ownership rules(CVE-2017-13861)