IOHIDeous OS X Local Kernel Vulnerability

Re:IOHIDeous OS X Local Kernel Vulnerability by Godel_unicode on Monday January 01, 2018 @12:39AM (#16044870)

> I'm curious the motivations to release such a serious, and complex, 0day on new years eve!?

CVE 2018-0001, it's all about namespaces.

[ Parent | on HN ]

Re:IOHIDeous OS X Local Kernel Vulnerability by tlrobinson on Monday January 01, 2018 @04:21AM (#16045390)

CVE 2018-0002: Flaw in CVE numbering procedure incentivizes dropping zero days on New Year’s Eve.

[ Parent | on HN ]

Re:IOHIDeous OS X Local Kernel Vulnerability by stevekemp on Monday January 01, 2018 @09:53AM (#16046240)

I remember waiting to report a security issue with some trivial setuid application until January, back a few years, specifically so I could claim the first CVE of the year.

I was unlucky and it didn't work out, but come December time I do wonder if I should dedicate more time to audits ..

[ Parent | on HN ]

Re:IOHIDeous OS X Local Kernel Vulnerability by floatingatoll on Monday January 01, 2018 @02:05AM (#16045063)

Bonus points if they issue it as CVE-2018-65536 (pen-test the world, so to speak)

EDIT: "No one would ever store the CVE incrementing fragment as a 16-bit unsigned int!"

[ Parent | on HN ]

Re:IOHIDeous OS X Local Kernel Vulnerability by jacquesm on Monday January 01, 2018 @08:07AM (#16045922)

Or in the pattern CVE-dddd-dddd ...

For additional fun, find a buffer overrun based on the CVE ID.

[ Parent | on HN ]

Re:IOHIDeous OS X Local Kernel Vulnerability by JdeBP on Tuesday January 02, 2018 @11:28AM (#16052869)

You yourself clearly do not. (-:

[ Parent | on HN ]

Re:IOHIDeous OS X Local Kernel Vulnerability by codezero on Monday January 01, 2018 @03:44PM (#16047945)

Looks like that number was already reserved for a still unpublished vuln. We’re already up to > 3000 in 2018!

[ Parent | on HN ]