CVE-2009-1235: High severity Apple iOS and macOS vulnerability
XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space and the HFS IOCTL handler, which allows local users to overwrite kernel memory and gain privileges by attaching an HFS+ disk image and performing certain steps involving HFSGETBOOTINFO fcntl calls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Prevent local users from attaching or mounting untrusted HFS+ disk images. Restrict disk-image mount/attach operations to trusted administrators or trusted processes to avoid exposing the HFS IOCTL handler (avoid mounting HFS+ images from untrusted sources).
- Operational
Audit systems for attached HFS+ disk images and unmount or remove any untrusted HFS+ images. Monitor and investigate attempts to invoke HFS_GET_BOOT_INFO fcntl calls or other unexpected interactions with the HFS IOCTL handler.
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1235?
CVE-2009-1235 is considered to have a high severity due to its ability to allow local users to overwrite kernel memory and gain elevated privileges.
How do I fix CVE-2009-1235?
To fix CVE-2009-1235, users should upgrade to a patched version of Mac OS X 10.5.7 or later.
Which versions of Mac OS X are affected by CVE-2009-1235?
CVE-2009-1235 affects Mac OS X versions 10.5.6 and earlier, as well as various versions of Mac OS X Server.
What type of vulnerability is CVE-2009-1235?
CVE-2009-1235 is a privilege escalation vulnerability related to improper restrictions in the HFS IOCTL handler.
Can local users exploit CVE-2009-1235?
Yes, local users can exploit CVE-2009-1235 by attaching an HFS+ disk image and performing specific actions.