CVE-2014-8611

Vulnerability

The __sflush function in fflush.c in the standard I/O library (libc) of FreeBSD 10.1 and the kernel of Apple iOS before version 9 mishandles failures of the write(2) system call. When a write operation fails, the function erroneously adjusts the buffered stream's internal state as if the write succeeded, leading to an accounting mismatch. This bug is present in FreeBSD 10.1 and iOS versions prior to 9 [1][3].

Exploitation

An attacker must cause a write system call to fail while a program is using buffered I/O and subsequently calls fflush(). This can be achieved by, for example, filling the filesystem, triggering a network error, or other conditions that cause write() to return an error. The attacker then needs to provide a crafted application that exploits the resulting heap buffer overflow. No authentication or special network position is required if the attacker can execute code or influence the program's environment [3].

Impact

Successful exploitation leads to a heap-based buffer overflow. This can result in data corruption or arbitrary code execution at the privilege level of the calling program. In the context of the kernel (iOS), this could mean kernel-level code execution. Denial of service is also possible [1][3].

Mitigation

FreeBSD released a fix in version 10.1-RELEASE-p1 and later, available via binary patch or source update [3]. Apple addressed the issue in iOS 9 [1]. No workaround is available for FreeBSD. Users should update to the patched versions immediately.