CVE-2015-6995

Related Files

IOHDIXControllerUserClient:convertClientBuffer Integer Overflow

Posted Jan 27, 2016

Authored by Google Security Research, Ian Beer

Method 5 of the IOHDIXController user client is createDrive64. This takes a 0x10 0 byte structure input from which it reads a userspace pointer and a size which it passes to IOHDIXController::convertClientBuffer. This wraps the memory pointed to by the userspace pointer in an IOMemoryDescriptor then takes the user-provided size, casts it to a 32-bit type and adds one. It passes that value to IOMalloc. By passing a size of 0xffffffff we can cause an integer overflow and IOMalloc will be passed a size of 0. IOMalloc falls through to kalloc which will quite happily make a 0-sized allocation for us and return a valid, writable kernel heap pointer.

tags | exploit, overflow, kernel

systems | linux

advisories | CVE-2015-6995

SHA-256 | 7c1b4d44f576a45333e8a5f38a438bc7780560237ca558e684660c3e2a87a9cb

Download | Favorite | View