Title: Apple Mac OS X Kernel - Null Pointer Dereference in nvCommandQueue::GetHandleIndex in GeForce.kext EDB-ID: 39920 CVE: 2016-1846 Author: Google Security Research Type: Denial of Service (DOS) Platform: OS X Date: 2016-06-10 Vulnerable App: Nvidia GeForce Driver (GeForce.kext) Verification: EDB Verified (✓) Vulnerability Details: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=784 Issue: The method doesn't check whether is non-null before using it. Exploit: By racing a call to this method with another thread calling , it's possible to get a NULL pointer. Mapping the NULL page in userspace leads to trivial kernel RIP control. Tested On: OS X 10.11.4 (15E65) MacBookPro 10,1 Tags: Exploit DOS OS X Advisory/Source: Link: Project Zero Bug Report