Add content: CVE-2024-44236 Remote Code Execution in Apple macOS sips Uti...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.thezdi.com/blog/2025/5/7/cve-2024-44236-remote-code-execution-vulnerability-in-apple-macos
• Blog Title: CVE-2024-44236: Remote Code Execution in Apple macOS sips Utility
• Suggested Section: generic-hacking/binary-exploitation (or a new “Heap Exploitation” category)

🎯 Content Summary

Overview

An out-of-bounds write in Apple’s sips utility (macOS 15.0.1, sips-307) occurs due to improper validation of the lutAToBType and lutBToAType ICC profile tag types (CVE-2024-44236). A crafted ICC file can trigger reads and zero-writes up to 16 bytes past the heap buffer, enabling arbitrary code execution under user privileges.

ICC Profile Format

• Header (128 bytes) – Contains profile ...

  🔧 Technical Details

  An out-of-bounds write vulnerability in Apple’s sips ICC profile parser arises from insufficient validation of the Offset to CLUT field in lutAToBType and lutBToAType tags: the parser reads and zero-writes 16 bytes starting at this attacker-controlled offset without ensuring it lies within the tagged element data, enabling heap buffer overflow.

  By crafting an ICC profile where the tag’s offsetToCLUT equals its tagDat...

  🤖 Agent Actions

  I’ve added a new exploit write-up under the Arbitrary Write → Exec section:

  • src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md

  This documents the CVE-2024-44236 OOB write in Apple’s sips ICC parser, covers vulnerable code, exploitation steps, impact, detection guidance, and references. Let me know if you’d like any adjustments!

  ✅ Review Checklist

  • Content is technically accurate
  • Formatting follows HackTricks style guidelines
  • Links and references are working
  • Content adds educational value
  • No sensitive information is exposed

  ---

  This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

  📚 Repository Maintenance

  • MD files processed: 846
  • MD files fixed: 20

  All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.thezdi.com/blog/2025/5/7/cve-2024-44236-remote-code-execution-vulnerability-in-apple-macos

Content Categories: Based on the analysis, this content was categorized under "generic-hacking/binary-exploitation (or a new “Heap Exploitation” category)".

Repository Maintenance:

• MD Files Formatting: 846 files processed (20 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0