Vulnerability CVE-2016-7644

Vulnerability CVE-2016-7644

Published: 2017-02-20

Description:

An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (use-after-free) via a crafted app.

See advisories in our WLB2 database:

	Topic	Author	Date
High	macOS 10.12 XNU UaF due to lack of locking in set_dp_control_port	ianbeer	16.12.2016

Type:

CWE-416

(Use After Free)

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score	Impact Subscore	Exploitability Subscore
9.3/10	10/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
Complete	Complete	Complete

Affected software
Apple -> Watch os
Apple -> Mac os x
Apple -> Iphone os
Apple -> Watchos

References:

http://www.securityfocus.com/bid/94904

http://www.securitytracker.com/id/1037469

https://support.apple.com/HT207422

https://support.apple.com/HT207423

https://support.apple.com/HT207487

https://www.exploit-db.com/exploits/40931/

Copyright 2024, cxsecurity.com