Apple Intel GPU Driver Use-After-Free Double-Delete

UaF/Double-delete due to bad locking in Apple Intel GPU driver

CVE-2018-4334


This PoC file might look familiar; this bug is a trivial variant of CVE-2016-1744 (Apple bug i UaF/Double-delete due to bad locking in Apple Intel GPU driver

CVE-2018-4334


This PoC file might look familiar; this bug is a trivial variant of CVE-2016-1744 (Apple bug id 635599405.)

That report showed the bug in the unmap_user_memory external methods; a variant also exists
in the map_user_memory external methods.

The intel graphics drivers have their own hash table type IGHashTable which isn't thread-safe.

map_user_memory manipulates an IGHashTable without locking leading to memory issues (eg UaFs and/or double-frees)

tested on MacOS 10.13.5 (17F77) on MacBookPro10,1



Found by: ianbeer