MacOS Insecure Swap File

Published
Credit
Risk
2017.05.18
ianbeer
Low
CWE
CVE
Local
Remote
N/A
CVE-2017-2494
Yes
No

CVSS Base Score
Impact Subscore
Exploitability Subscore
9.3/10
10/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete

MacOS uses an insecure swap file

CVE-2017-2494


This came out of a discussion with Jann Horn this afternoon; credit is his.

It turns out that even with SIP enabled a regular root user can write to the swapfile under /private/var/vm/swapfile0.

That file is created on demand when the system starts to swap; if you can't see it increase system load.

Then as root (with SIP enabled) do:

cat /dev/urandom > /private/var/vm/swapfile0

We observed multiple interesting-looking kernel panics including in the swapfile decompression code and also the intel GPU driver doing something with GPU pages.



Found by: ianbeer


See this note in RAW Version

 
Bugtraq RSS
Bugtraq
 
CVE RSS
CVEMAP
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn


Copyright 2017, cxsecurity.com