{"action":"created","issue":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/135","labels_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/135/labels{/name}","comments_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/135/comments","events_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/135/events","html_url":"https://github.com/chrsmith/google-security-research/issues/135","id":58936920,"number":135,"title":"OS X IOKit kernel code execution due to NULL pointer dereference in IntelAccelerator","user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/auto-migrated","name":"auto-migrated","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CCProjectZeroMembers","name":"CCProjectZeroMembers","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CVE-2014-4486","name":"CVE-2014-4486","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Deadline-90","name":"Deadline-90","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Deadline-Exceeded","name":"Deadline-Exceeded","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Finder-ianbeer","name":"Finder-ianbeer","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Fixed-2015-Jan-27","name":"Fixed-2015-Jan-27","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Id-612956440","name":"Id-612956440","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Product-IOKit","name":"Product-IOKit","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Reported-2014-Oct-21","name":"Reported-2014-Oct-21","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Severity-High","name":"Severity-High","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Vendor-Apple","name":"Vendor-Apple","color":"ededed"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-02-25T17:16:16Z","updated_at":"2015-02-25T17:16:17Z","closed_at":"2015-02-25T17:16:16Z","body":"```\nI wrote a little program to run over every IOKit IOService userclient type from \n1 to 100 and just call IOConnectMapMemory for all the memory type values from 1 \nto 1000.\n\nCalling IOConnectMapMemory on userclient type 2 of \"IntelAccelerator\" with \nmemory type 3 hits an exploitable kernel NULL pointer dereference calling a \nvirtual function on an object at 0x0.\n\nAttached PoC exploits this to get root.\n\n(The cleanup ROP uses a hardcoded offset for 10.9.5.)\n```\n\n-----\nOriginal issue reported on code.google.com by `ianb...@google.com` on 21 Oct 2014 at 11:15\n\nAttachments:\n* [ig_2_3_exploit.c](https://storage.googleapis.com/google-code-attachments/google-security-research/issue-135/comment-0/ig_2_3_exploit.c)\n"},"comment":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/comments/76006802","html_url":"https://github.com/chrsmith/google-security-research/issues/135#issuecomment-76006802","issue_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/135","id":76006802,"user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"created_at":"2015-02-25T17:16:17Z","updated_at":"2015-02-25T17:16:17Z","body":"\n\n-----\nOriginal comment by `ianb...@google.com` on 22 Oct 2014 at 12:54\n* Added labels: **Reported-2014-Oct-21**, **Id-612956440**"}}