CVE-2015-7078

A local attacker opens an `AppleHV` user client connection via `IOServiceOpen`, then sends an IOConnectCallMethod (method 1) to the service [ref_id=1]. The attacker then kills the process (e.g., via `kill -9` from a forked child process) while the connection is active. The termination path triggers two separate calls to `lck_rw_free` on the same `hv_space` lock group pointer — once from `AppleHVClient::free` and once from the hypervisor thread-destroy callback — resulting in a use-after-free of the lock group object [ref_id=1]. This can be leveraged for local privilege escalation.

The vulnerability resides in the AppleHV kernel extension's handling of lock groups. The `AppleHVClient::free` method (called via `IOService::terminateWorker`) and the `hv_callback_thread_destroy` callback both call `lck_rw_free` on the same lock group pointer obtained from the global `_hv` variable [ref_id=1]. This double-free of the lock group structure is the core defect.

The advisory does not include a patch diff, but the fix in OS X 10.11.2 addresses the double-free by ensuring the `hv_space` lock group is freed only once during process teardown [ref_id=1]. The remediation likely adds a reference count or a NULL-out check so that the second call to `lck_rw_free` does not operate on an already-freed lock group pointer. No further technical details of the fix are provided in the available reference.

Compile and run the provided PoC on OS X 10.11 (El Capitan 15a284). The program forks a child that repeatedly opens an AppleHV user client connection and calls IOConnectCallMethod with method 1, while the parent sleeps for one second then sends SIGKILL to the child. The race between the two free paths triggers the use-after-free [ref_id=1].