CVE-2017-2388 PoC — Apple macOS Sierra IOFireWireFamily 安全漏洞

Source

https://github.com/bazad/IOFireWireFamily-null-deref

Associated Vulnerability

Title:Apple macOS Sierra IOFireWireFamily 安全漏洞 (CVE-2017-2388)
Description:An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "IOFireWireFamily" component. It allows attackers to cause a denial of service (NULL pointer dereference) via a crafted app.

Description

CVE-2017-2388: Null-pointer dereference in IOFireWireFamily.

Readme

## IOFireWireFamily-null-deref

IOFireWireFamily-null-deref is a proof-of-concept exploit for CVE-2017-2388, a NULL pointer
derefererence in `IOFireWireUserClient` that was fixed in [macOS Sierra 10.12.4]. This
vulnerability can be triggered to cause denial of service on devices with a FireWire port.

[macOS Sierra 10.12.4]: https://support.apple.com/en-us/HT207615

### CVE-2017-2388

The function `IOFireWireUserClient::setAsyncRef_IsochChannelForceStop` did not check that the
parameter `inAsyncRef` is non-NULL before calling `bcopy` with `inAsyncRef` as the source.

### License

The IOFireWireFamily-null-deref code is released into the public domain. As a courtesy I ask that
if you reference or use any of this code you attribute it to me.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!