CVE-2018-4241

An attacker crafts a malicious app that calls `connectx` with a socket address whose `sa_family` is neither `AF_INET` nor `AF_INET6` but whose `sa_len` field is set to a value larger than the expected structure size. The kernel's `mptcp_usr_connectx` function skips the length-validation checks (which only apply to `AF_INET` and `AF_INET6`) and proceeds to `memcpy(&mpte->mpte_dst, dst, dst->sa_len)`, copying attacker-controlled data beyond the bounds of the destination buffer [ref_id=1]. This overwrites adjacent kernel heap fields, including `mpte_itfinfo`, leading to a controlled pointer being passed to `kfree` when the socket is closed, enabling arbitrary code execution in kernel context [ref_id=1].

The vulnerability is in the `mptcp_usr_connectx` function, which is the handler for the `connectx` syscall for the `AP_MULTIPATH` socket family in the XNU kernel. The function fails to reject socket addresses with a `sa_family` other than `AF_INET` or `AF_INET6`, yet still performs a `memcpy` using the attacker-controlled `sa_len` value (up to 255) into the `mpte_dst` buffer [ref_id=1].

The advisory does not include a patch diff, but the root cause is clear: the function must validate that the socket address family is either `AF_INET` or `AF_INET6` before trusting the `sa_len` field, and should return an error (`EINVAL`) for any other family. The existing validation checks for IPv4 and IPv6 lengths are correct, but they are gated on the address family — if the family is neither, no check runs and the code falls through to the vulnerable `memcpy` [ref_id=1]. A proper fix would add an `else` branch (or an early bail-out) that rejects unsupported address families.

A public PoC is available at https://www.exploit-db.com/exploits/44849/ and the binary at https://gitlab.com/exploit-db/exploitdb-bin-sploits/-/raw/main/bin-sploits/44849.zip [ref_id=1]. The PoC triggers the buffer overflow by passing a socket address with an unsupported `sa_family` and a large `sa_len`, overwriting the `mpte_itfinfo` field to cause a controlled `kfree` on socket close. On macOS the PoC must be run as root; on iOS 11 it can run inside the app sandbox with the multipath entitlement [ref_id=1].