Merge pull request #1041 from HackTricks-wiki/update_CVE-2024-44236__Remote_Code_Execution_in_Apple_mac_20250708_181937

Add content: CVE-2024-44236 Remote Code Execution in Apple macOS sips Uti...

Author: carlospolop

src/AI/AI-llm-architecture/1.-tokenizing.md

@@ -99,4 +99,4 @@ print(token_ids[:50])
 - [https://www.manning.com/books/build-a-large-language-model-from-scratch](https://www.manning.com/books/build-a-large-language-model-from-scratch)
 
 
-{{#include /banners/hacktricks-training.md}}
+{{#include /banners/hacktricks-training.md}}

src/AI/AI-llm-architecture/2.-data-sampling.md

@@ -241,4 +241,4 @@ tensor([[  367,  2885,  1464,  1807],
 - [https://www.manning.com/books/build-a-large-language-model-from-scratch](https://www.manning.com/books/build-a-large-language-model-from-scratch)
 
 
-{{#include /banners/hacktricks-training.md}}
+{{#include /banners/hacktricks-training.md}}

src/AI/AI-llm-architecture/3.-token-embeddings.md

@@ -219,4 +219,4 @@ print(input_embeddings.shape) # torch.Size([8, 4, 256])
 - [https://www.manning.com/books/build-a-large-language-model-from-scratch](https://www.manning.com/books/build-a-large-language-model-from-scratch)
 
 
-{{#include /banners/hacktricks-training.md}}
+{{#include /banners/hacktricks-training.md}}

src/AI/AI-llm-architecture/5.-llm-architecture.md

@@ -702,4 +702,4 @@ print("Output length:", len(out[0]))
 - [https://www.manning.com/books/build-a-large-language-model-from-scratch](https://www.manning.com/books/build-a-large-language-model-from-scratch)
 
 
-{{#include /banners/hacktricks-training.md}}
+{{#include /banners/hacktricks-training.md}}

src/SUMMARY.md

@@ -795,6 +795,7 @@
     - [BF Forked & Threaded Stack Canaries](binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/bf-forked-stack-canaries.md)
     - [Print Stack Canary](binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/print-stack-canary.md)
 - [Write What Where 2 Exec](binary-exploitation/arbitrary-write-2-exec/README.md)
+  - [Aw2exec Sips Icc Profile](binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md)
   - [WWW2Exec - atexit()](binary-exploitation/arbitrary-write-2-exec/www2exec-atexit.md)
   - [WWW2Exec - .dtors & .fini_array](binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md)
   - [WWW2Exec - GOT/PLT](binary-exploitation/arbitrary-write-2-exec/aw2exec-got-plt.md)

src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md

@@ -0,0 +1,55 @@
+# WWW2Exec - sips ICC Profile Out-of-Bounds Write (CVE-2024-44236)
+
+{{#include ../../banners/hacktricks-training.md}}
+
+## Overview
+
+An out-of-bounds write vulnerability in Apple macOS Scriptable Image Processing System (`sips`) ICC profile parser (macOS 15.0.1, sips-307) due to improper validation of the `offsetToCLUT` field in `lutAToBType` (`mAB `) and `lutBToAType` (`mBA `) tags. A crafted ICC file can trigger zero-writes up to 16 bytes past the heap buffer, corrupting heap metadata or function pointers and enabling arbitrary code execution (CVE-2024-44236).
+
+## Vulnerable Code
+
+The vulnerable function reads and zeroes 16 bytes starting from an attacker-controlled offset without ensuring it lies within the allocated buffer:
+
+```c
+// Pseudocode from sub_1000194D0 in sips-307 (macOS 15.0.1)
+for (i = offsetToCLUT; i < offsetToCLUT + 16; i++) {
+    if (i > numberOfInputChannels && buffer[i] != 0)
+        buffer[i] = 0;
+}
+```
+
+Only a check `offsetToCLUT <= totalDataLength` is performed. By setting `offsetToCLUT == tagDataSize`, the loop indexes up to 16 bytes past the end of `buffer`, corrupting adjacent heap metadata.
+
+## Exploitation Steps
+
+1. **Craft malicious `.icc` profile:**
+   - Build the ICC header (128 bytes) with signature `acsp` and a single `lutAToBType` or `lutBToAType` tag entry.
+   - In the tag table, set `offsetToCLUT` equal to the tag's `size` (`tagDataSize`).
+   - Place attacker-controlled data immediately after the tag data block to overwrite heap metadata.
+2. **Trigger parsing:**
+
+   ```bash
+   sips --verifyColor malicious.icc
+   ```
+
+3. **Heap metadata corruption:** The OOB zero-writes overwrite allocator metadata or adjacent pointers, allowing the attacker to hijack control flow and achieve arbitrary code execution in the context of the `sips` process.
+
+## Impact
+
+Successful exploitation results in remote arbitrary code execution at user privilege on macOS systems running the vulnerable `sips` utility.
+
+## Detection
+
+- Monitor file transfers on common protocols (FTP, HTTP/S, IMAP, SMB, NFS, SMTP).  
+- Inspect transferred files with signature `acsp`.  
+- For each `mAB ` or `mBA ` tag, verify if the `Offset to CLUT` field equals the `Tag data size`.  
+- Flag as suspicious if this condition is met.
+
+## References
+
+- ZDI blog: CVE-2024-44236: Remote Code Execution Vulnerability in Apple macOS sips Utility  
+  https://www.thezdi.com/blog/2025/5/7/cve-2024-44236-remote-code-execution-vulnerability-in-apple-macos  
+- Apple October 2024 Security Update (patch shipping CVE-2024-44236)  
+  https://support.apple.com/en-us/121564
+
+{{#include /banners/hacktricks-training.md}}

src/binary-exploitation/array-indexing.md

@@ -19,3 +19,5 @@ However he you can find some nice **examples**:
 
 
 
+
+{{#include /banners/hacktricks-training.md}}

src/binary-exploitation/common-binary-protections-and-bypasses/stack-canaries/bf-forked-stack-canaries.md

@@ -122,3 +122,5 @@ Check also the presentation of [https://www.slideshare.net/codeblue_jp/master-ca
 
 
 
+
+{{#include /banners/hacktricks-training.md}}

src/binary-exploitation/ios-exploiting.md

@@ -213,4 +213,4 @@ void iosurface_kwrite64(uint64_t addr, uint64_t value) {
 With these primitives, the exploit provides controlled **32-bit reads** and **64-bit writes** to kernel memory. Further jailbreak steps could involve more stable read/write primitives, which may require bypassing additional protections (e.g., PPL on newer arm64e devices).
 
 
-{{#include /banners/hacktricks-training.md}}
+{{#include /banners/hacktricks-training.md}}

src/binary-exploitation/libc-heap/use-after-free/first-fit.md

@@ -65,3 +65,5 @@ d = malloc(20);   // a
 
 
 
+
+{{#include /banners/hacktricks-training.md}}