Published: 20/02/2017 Updated: 14/08/2020

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 765

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

An issue exists in certain Apple products. iOS prior to 10.1 is affected. macOS prior to 10.12.1 is affected. tvOS prior to 10.0.1 is affected. watchOS prior to 3.1 is affected. The issue involves the "Kernel" component. It allows local users to execute arbitrary code in a privileged context or cause a denial of service (MIG code mishandling and system crash) via unspecified vectors.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apple iphone os
apple mac os x
apple tvos
apple watchos

Source: bugschromiumorg/p/project-zero/issues/detail?id=882 mach_ports_register is a kernel task port MIG method It's defined in MIG like this: routine mach_ports_register( target_task : task_t; init_port_set : mach_port_array_t = ^array[] of mach_port_t); Looking at the generated code for this we notice som ...

This Metasploit module exploits a JIT optimization bug in Safari Webkit This allows us to write shellcode to an RWX memory section in JavaScriptCore and execute it The shellcode contains a kernel exploit (CVE-2016-4669) that obtains kernel rw, obtains root and disables code signing Finally we download and execute the meterpreter payload This mo ...

This module exploits a JIT optimization bug in Safari Webkit This allows us to write shellcode to an RWX memory section in JavaScriptCore and execute it The shellcode contains a kernel exploit (CVE-2016-4669) that obtains kernel rw, obtains root and disables code signing Finally we download and execute the ...

This module exploits a JIT optimization bug in Safari Webkit. This allows us to write shellcode to an RWX memory section in JavaScriptCore and execute it. The shellcode contains a kernel exploit (CVE-2016-4669) that obtains kernel rw, obtains root and disables code signing. Finally we download and execute the meterpreter payload. This module has been tested against iOS 7.1.2 on an iPhone 4.

msf > use exploit/apple_ios/browser/safari_jit
msf exploit(safari_jit) > show targets
    ...targets...
msf exploit(safari_jit) > set TARGET < target-id >
msf exploit(safari_jit) > show options
    ...show and set options...
msf exploit(safari_jit) > exploit

CWE-20 https://support.apple.com/HT207275 https://support.apple.com/HT207271 https://support.apple.com/HT207270 https://support.apple.com/HT207269 http://www.securityfocus.com/bid/93849 http://www.securitytracker.com/id/1037086 https://www.exploit-db.com/exploits/40654/http://packetstormsecurity.com/files/158874/Safari-Webkit-For-iOS-7.1.2-JIT-Optimization-Bug.html https://nvd.nist.gov https://www.exploit-db.com/exploits/40654/https://www.rapid7.com/db/modules/exploit/apple_ios/browser/safari_jit/

CVE-2016-4669

Vulnerability Summary

Vulnerability Trend

Exploits

Metasploit Modules

References

Vulmon Search

About

Products

Connect