20 lines
No EOL
671 B
Text
20 lines
No EOL
671 B
Text
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1175
|
|
|
|
CAMediaTimingFunctionBuiltin is a class in QuartzCore. Its initWithCoder: method
|
|
reads an Int "index" then passes that to builtin_function
|
|
|
|
mov ebx, edi <-- controlled unsigned int
|
|
mov r14d, ebx
|
|
lea r15, __ZL9functions_0 ; functions
|
|
mov rax, [r15+r14*8]
|
|
|
|
if rax is non-null it's returned as an objective-c object pointer and the objective-c retain
|
|
selector is sent to it.
|
|
|
|
Serialized poc in attached file with an index of 12345678.
|
|
|
|
tested on MacOS 10.12.3 (16D32)
|
|
|
|
|
|
Proof of Concept:
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42052.zip |