Subscribe via feed.

AppleAVD AppleAVDUserClient::decodeFrameFig Memory Corruption

Posted by deepcore on November 19, 2022 – 2:21 pm

In the function AppleAVDUserClient::decodeFrameFig, a location in the decoder’s IOSurface input buffer is calculated, and then bzero is called on it. The size of this IOSurface’s allocation is controllable by the userspace caller, so the calculated pointer can go out of bounds, leading to memory corruption. This issue could potentially allow an unprivileged local application to escalate its privileges to the kernel.


This post is under “exploit” and has no respond so far.
If you enjoy this article, make sure you subscribe to my RSS Feed.

Post a reply

You must be logged in to post a comment.