CVE-2018-18327

Vulnerability

The vulnerability resides in the KERedirect kernel extension (kext) of Trend Micro Antivirus for Mac (Consumer) version 7.0 (2017) and above [1]. The issue is an untrusted pointer dereference at offset 0x6eDC of a user-supplied buffer. The kext fails to properly validate the user-supplied value before dereferencing it as a pointer, allowing an attacker to control the pointer target.

Exploitation

Exploitation requires the attacker to first obtain the ability to execute low-privileged code on the target system [1]. With that capability, the attacker can craft a malicious buffer and pass it to the KERedirect kext via the vulnerable IOCTL or similar interface. The lack of validation on the pointer at offset 0x6eDC causes the kernel to dereference an attacker-controlled address, leading to arbitrary kernel memory access.

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the kernel, resulting in full privilege escalation to root or kernel level [1]. This compromises the confidentiality, integrity, and availability of the system.

Mitigation

Trend Micro has released a security update to address this vulnerability. Users should update their Trend Micro Antivirus for Mac to the latest version available [1]. No workarounds are documented; applying the vendor patch is the recommended mitigation.