Skip to content
This repository has been archived by the owner on Oct 3, 2023. It is now read-only.

Latest commit

 

History

History
11 lines (9 loc) · 671 Bytes

CVE-2022-32866.md

File metadata and controls

11 lines (9 loc) · 671 Bytes
Raw

CVE-2022-32866

There is a violation of MIG semantics in IOUserUserClient::externalMethod: Assuming an asyncWakePort is given, _ExternalMethod will be called and if it returns success, the port will be released:

if (MACH_PORT_NULL != wake_port) {
    // this release is for the mig created send right
    iokit_release_port_send(wake_port);
}

However, the method is still able to fail after this point (when _ExternalMethod returned something in structureOutput and the length of this data is more than the client application expected), resulting in an over-release of the asyncWakePort because it will also be freed by MIG (due to the error response).