CVE-2015-7078

Related Files

OS X Kernel Hypervisor Driver Use-After-Free

Posted Jan 27, 2016

Authored by Google Security Research, Ian Beer

The hv_space lock group gets an extra ref dropped when you kill a process with an AppleHV userclient; one via IOService::terminateWorker calling the AppleHVClient::free method (which calls lck_rw_free on the lock group using the pointer hanging off the global _hv variable) and secondly via the hypervisor machine_thread_destroy callback (hv_callback_thread_destroy) which also calls lck_rw_free with a lock group pointer taken from _hv.

tags | exploit

systems | linux

advisories | CVE-2015-7078

SHA-256 | 05bbdc4f970de720232f0fe75333057f8dbe21b2c91a3d821e577be39c6aed9b

Download | Favorite | View