... Loading ...

SSD Secure Disclosure

Disclosing vulnerabilities responsibly since 2007
Dark Theme

SSD Advisory – iOS/macOS Kernel task_inspect Information Leak

Vulnerabilities Summary
The following advisory discusses a bug found in the kernel function task_inspect which a local user may exploit in order to read kernel memory due to an uninitialized variable.
Vendor Response
“Kernel:
Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation
Impact: A local user may be able to read kernel memory
Description: A memory initialization issue was addressed with improved memory handling.
CVE-2018-4431: An independent security researcher has reported this vulnerability to
Beyond Security’s SecuriTeam Secure Disclosure program
Kernel:
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.1
Impact: A local user may be able to read kernel memory
Description: A memory initialization issue was addressed with
improved memory handling.
CVE-2018-4431: An independent security researcher has reported this
vulnerability to Beyond Security’s SecuriTeam Secure Disclosure
program”
CVE
CVE-2018-4431
Credit
An independent Security Researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

Affected systems
macOS 10.13.6 and prior versions
iOS 12.1.0 and prior versions
Vulnerability Details
The bug is in the function task_inspect:

In the case that flavor is TASK_INSPECT_BASIC_COUNTS, the stack variable task_counts will not be initialized. By making the function mt_fixed_task_counts => mt_fixed_thread_counts return
error, the task_counts will not be initialized and it will be returned to user mode.
By using the API function thread_selfcounts with a race condition we can make it return error.
Another impact is that the functions task_inspect and thread_selfcounts does not include any MACF check, so this bug can be triggered in ANY sandbox.
PoC

Print Friendly, PDF & Email

One thought on “SSD Advisory – iOS/macOS Kernel task_inspect Information Leak

Leave a Reply