16
edits
Changes
Jump to navigation
Jump to search
Line 27:
Line 27: + + + + + + +
no edit summary
==IOSU module exploits==
==IOSU module exploits==
=== ioctlvhax - ioctlv TOCTOU (fixed with 5.2.0) ===
While technically this flaw lies in the kernel though it can be used to exploit a usermode module.
This allows to change an ioctlv vector buffer address entry after it has been validated by the kernel. Any module not checking the number of ioctlv vectors is vulnerable.
==IOSU kernel exploits==
==IOSU kernel exploits==
=== IOS_CreateThread unchecked memset ===
This system call will fill the stack of the newly created thread with a predefined constant (0xFA5A5A5A) without validating the passed stack address.