关联漏洞
标题：
Apple macOS 权限许可和访问控制问题漏洞
(CVE-2021-30731)
描述：Apple macOS是美国苹果（Apple）公司的一套专为Mac计算机所开发的专用操作系统。 macOS存在权限许可和访问控制问题漏洞，该漏洞的存在是由于IOUSBHostFamily内部不恰当地施加了安全限制。本地无特权应用程序可以捕获USB设备。该漏洞允许本地应用程序访问敏感信息。受影响的产品和版本包括:macOS:10.15 19a583、10.15 19a602、10.15 19a603、10.15.1 19b88、10.15.2 19c57、10.15.3 19d76、10.15.4 19e2
描述
PoC of CVE-2021-30731
介绍
# Webcam Viewer
Previews the connected webcam as a PoC of [CVE-2021-30731](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30731).
Must be running macOS 11.3.1 or lower or macOS 10.15 before Catalina Security Update 2021-004.
## Building
1. Install build prerequisites: `brew install autoconf automake cmake libtool pkg-config`
2. Build dependencies: `./bootstrap.sh`
3. Open the Xcode project and build.
## Usage
Select a UVD compatible USB webcam from the list. If it does not appear, unplug and replug the device. Note that built in FaceTime HD cameras on MacBooks cannot be captured because of `UsbUserClientEntitlementRequired`.
Tested working with the LG UltraFine 5K built-in webcam.
## Issues
Since this is just a PoC, there's a few bugs that's not been resolved.
* Frame tearing is observed. Unsure if this is a libuvc issue or not.
* Stopping and re-starting a preview fails and the app freezes.
* Force quitting the app results in the USB device being un-able to be used by the system again. A un-plug and re-plug is required.
文件快照
[4.0K] /data/pocs/8eefda2e6d507ca254a7b77122467885ccd02183
├── [1.1K] 0001-darwin-disable-entitlement-check.patch
├── [ 756] AppDelegate.h
├── [3.8K] AppDelegate.m
├── [4.0K] Assets.xcassets
│ ├── [4.0K] AccentColor.colorset
│ │ └── [ 123] Contents.json
│ ├── [4.0K] AppIcon.appiconset
│ │ └── [ 904] Contents.json
│ └── [ 63] Contents.json
├── [4.0K] Base.lproj
│ └── [ 53K] MainMenu.xib
├── [ 540] bootstrap.sh
├── [4.0K] libusb
├── [4.0K] libuvc
├── [ 11K] LICENSE
├── [1.0K] main.m
├── [1.0K] README.md
├── [ 361] WebcamViewer.entitlements
├── [4.0K] WebcamViewer.xcodeproj
│ ├── [ 16K] project.pbxproj
│ └── [4.0K] xcshareddata
│ └── [ 830] IDETemplateMacros.plist
├── [ 858] WVUVCDeviceDelegate.h
├── [ 999] WVUVCDevice.h
└── [8.8K] WVUVCDevice.m
8 directories, 17 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。