CVE-2016-1757

Published: Mar 24, 2016Modified: May 6, 2026

7.0

Vector

CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.0 / Impact: 5.9

Source: NVD

Description

Race condition in the kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context via a crafted app.

Affected (2)

Products: Apple: Iphone Os, Mac Os X

Apple

2 products

Iphone Os

Mac Os X

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Apple Iphone Os	Up to 9.2.1
Apple Mac Os X	Up to 10.11.3

Related CWEs

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (16)

http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html

Source: product-security@apple.com

Vendor Advisory

http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html

Source: product-security@apple.com

Vendor Advisory

http://www.securitytracker.com/id/1035353

Source: product-security@apple.com

https://bugs.chromium.org/p/project-zero/issues/detail?id=676

Source: product-security@apple.com

https://support.apple.com/HT206166

Source: product-security@apple.com

Vendor Advisory

https://support.apple.com/HT206167

Source: product-security@apple.com

Vendor Advisory

https://www.exploit-db.com/exploits/39595/

Source: product-security@apple.com

https://www.exploit-db.com/exploits/39741/

Source: product-security@apple.com

http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html