CVE-2016-1720
Apple Mac OSX - io_service_close Use-After-Free
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
IOKit in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
IOKit en Apple iOS en versiones anteriores a 9.2.1, OS X en versiones anteriores a 10.11.3 y tvOS en versiones anteriores a 9.1.1 permite a usuarios locales obtener privilegios o causar una denegación de servicio (corrupción de memoria) a través de vectores no especificados.
It turns out that the spoofed no-more-senders notification bug when applied to iokit objects was actually just a more complicated way to hit ::clientClose in parallel. You can in fact do this very simply by calling IOServiceClose on two threads. Like the spoofed notifications this leads to many bugs in many userclients, the exact nature of which depends on the semantics of the clientClose implementation.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-01-13 CVE Reserved
- 2016-01-20 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (12)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/135435/IOKit-Methods-Being-Called-Without-Locks-From-IOServiceClose.html | Third Party Advisory |
|
| http://www.securitytracker.com/id/1034736 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/39367 | 2024-08-05 | |
| https://code.google.com/p/google-security-research/issues/detail?id=597 | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html | 2019-03-22 | |
| http://lists.apple.com/archives/security-announce/2016/Jan/msg00003.html | 2019-03-22 | |
| http://lists.apple.com/archives/security-announce/2016/Jan/msg00005.html | 2019-03-22 | |
| http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html | 2019-03-22 | |
| https://support.apple.com/HT205729 | 2019-03-22 | |
| https://support.apple.com/HT205731 | 2019-03-22 | |
| https://support.apple.com/HT205732 | 2019-03-22 | |
| https://support.apple.com/HT206168 | 2019-03-22 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | < 10.11.3 Search vendor "Apple" for product "Mac Os X" and version " < 10.11.3" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Tvos Search vendor "Apple" for product "Tvos" | < 9.1.1 Search vendor "Apple" for product "Tvos" and version " < 9.1.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | < 9.2.1 Search vendor "Apple" for product "Iphone Os" and version " < 9.2.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Watchos Search vendor "Apple" for product "Watchos" | < 2.2 Search vendor "Apple" for product "Watchos" and version " < 2.2" | - |
Affected
| ||||||