EDB-ID: 42407 CVE: 2017-7047 Author: GOOGLE SECURITY RESEARCH Type: LOCAL Platform: MULTIPLE Date: 2017-08-01 Vulnerable App: Apple macOS/iOS Key Information: Summary: Apple macOS/iOS - 'xpc_data' Objects Sandbox Escape Privilege Escalation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1247 Vulnerability: The vulnerability involves the XPC (Xcopy) mechanism in macOS/iOS, where XPC serializes large objects, creating memory entry ports and transferring them to the receiving process. Exploit Mechanism: Crafted objects can lead to controlled memory corruption by targeting the serialized method type signature. Target Process: The airportd daemon, which runs as root, but can be applied to any NSXPC service. Exploit Reliability: Not highly reliable due to race conditions and heap grooming issues. Proof of Concept: Available at https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42407.zip