More Mac OS X and iPhone sandbox escapes and kernel bugs

Summary: Apple released OS X 10.9.5 and iOS 8, fixing a set of sandbox escapes and privilege escalation bugs found by Project Zero, most located through manual source code auditing and binary analysis. The bugs included a kernel ASLR bypass on OS X reachable from any sandbox via the unprivileged SGDT instruction, eight bounds-checking bugs in the Intel integrated HD GPU driver allowing controlled kernel memory corruption from most OS X sandboxes, and IOKit IODataQueue flaws affecting both OS X and iOS that Project Zero noted appeared similar to one used in the Pangu Team jailbreak released a few days after the bugs were reported to Apple.
Key Takeaway: Two of the listed bugs, CVE-2014-4404 and CVE-2014-4405, were fixed only on iOS and remained unpatched on OS X, and Project Zero states that sandbox break-outs on OS X and iOS are an under-researched topic.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2014-4376 CVE-2014-4389 CVE-2014-4390 CVE-2014-4394 CVE-2014-4395 CVE-2014-4396 CVE-2014-4397 CVE-2014-4398 CVE-2014-4399 CVE-2014-4400 CVE-2014-4401 CVE-2014-4402 CVE-2014-4403 CVE-2014-4404 CVE-2014-4416 CVE-2014-4418
Related: Deja-XNU Cyber Risks ·
CVE-2014-4404: Apple OS X Heap-Based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Feb 10, 2022
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026