Apple macOS/iOS – ‘CAMediaTimingFunctionBuiltin’ NSKeyedArchiver Memory Corruption Due to Lack of Bounds Checking
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1175 CAMediaTimingFunctionBuiltin is a class in QuartzCore. Its initWithCoder: method reads an Int "index" then passes that to builtin_function mov ebx, edi <-- controlled unsigned int mov r14d, ebx lea r15, __ZL9functions_0 ; functions mov rax, [r15+r14*8] if rax is non-null it's returned as an objective-c object pointer and the objective-c retain selector is sent to it. Serialized poc in attached file with an index of 12345678. tested on MacOS 10.12.3 (16D32) Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42052.zip |