Sips Icc Oob Write Exploit

SIPS ICC Profile OOB Write Exploit (CVE-2024-44236)

A skill for understanding, testing, and detecting the out-of-bounds zero-write vulnerability in Apple's Scriptable Image Processing System (sips) ICC profile parser.

What This Skill Does

This skill helps you:

• Generate malicious ICC profile test files for security research
• Understand the heap corruption mechanism and exploitation chain
• Create YARA detection rules for the vulnerability
• Verify patching status and implement mitigations
• Analyze embedded ICC profile attacks in images

Quick Start

Generate a Test ICC Profile

Run the bundled PoC generator to create a malicious ICC file:

python scripts/generate_evil_icc.py output/evil.icc

This creates a minimal ICC profile with the offsetToCLUT == tagDataSize condition that triggers the OOB write.

Verify the Vulnerability (Research Only)

On a vulnerable macOS system (15.0.1, sips-307):

sips --verifyColor output/evil.icc
# or
sips -s format png payload.jpg --out out.png

⚠️ Warning: Only test on isolated, vulnerable systems you own. This can cause crashes or code execution.

Vulnerability Overview

The Bug

The vulnerability is in the lutAToBType (mAB ) and lutBToAType (mBA ) tag handlers in sips-307:

if (offsetToCLUT <= tagDataSize) {
    // BAD: zero 16 bytes starting at offsetToCLUT
    for (uint32_t i = offsetToCLUT; i < offsetToCLUT + 16; i++)
        buffer[i] = 0;  // no bounds check!
}

When offsetToCLUT == tagDataSize, the parser writes 16 bytes past the allocated buffer.

Exploitation Chain

1. Craft malicious ICC with offsetToCLUT == tagDataSize
2. Trigger parsing via any sips operation (Preview, QuickLook, Mail, Safari)
3. Heap metadata corruption on nano_zone allocator
4. Arbitrary write via poisoned free list
5. Vtable overwrite → ROP chain execution

Impact

• CVSS 7.8 - Remote code execution
• Bypasses Gatekeeper (embedded in benign images)
• Affects: Preview, QuickLook, Safari, Mail attachments
• Patched: macOS 15.2 / 14.7.1 (Oct 30, 2024)

Detection

YARA Rule

Use the bundled YARA rule to detect malicious ICC profiles:

yara -r scripts/icc_mab_anomaly.yara /path/to/files/

The rule checks for:

• Valid ICC header (acsp magic)
• mAB or mBA tags
• offsetToCLUT == tagDataSize condition

Manual Verification

Check if a system is patched:

# Check macOS version
sw_vers

# Check sips version (vulnerable: 307 on 15.0.1)
# Patched in 15.2 / 14.7.1+

DFIR Indicators

Look for in unified log:

• Recent sips --verifyColor execution
• ColorSync library loads by sandboxed apps
• Unexpected Preview/QuickLook spawns

Mitigation

Immediate Actions

1. Patch: Update to macOS ≥ 15.2 / 14.7.1 or iOS/iPadOS ≥ 18.1
2. Strip ICC profiles from untrusted images:

   exiftool -icc_profile= -overwrite_original <file>
   

3. Deploy YARA rule on email gateways and EDR
4. Sandbox Preview/QuickLook for unknown content

Long-term Hardening

• Run image processing in isolated VMs
• Monitor for sips/ColorSync anomalies
• Implement file type validation before processing

Test Cases

Case 1: Basic OOB Trigger

python scripts/generate_evil_icc.py test1.icc
sips --verifyColor test1.icc  # Should crash on vulnerable systems

Case 2: Embedded in Image

# Create a test image with embedded malicious ICC
python scripts/embed_icc_in_image.py input.jpg test1.icc output.jpg
sips -s format png output.jpg --out out.png

Case 3: YARA Detection

yara scripts/icc_mab_anomaly.yara test1.icc
# Should match: ICC_mAB_offsetToCLUT_anomaly

References

• ZDI-24-1445: Trend Micro advisory on CVE-2024-44236 https://www.zerodayinitiative.com/advisories/ZDI-24-1445/
• Apple HT213981: macOS Sonoma 15.2 security content https://support.apple.com/en-us/HT213981
• CVE-2025-24185: Related variant (patched April 2025)

Related Skills

• icc-profile-analysis - Deep ICC profile parsing and analysis
• macos-heap-exploitation - nano_zone allocator exploitation techniques
• yara-rule-creation - Writing detection rules for file-based attacks

Notes

• This skill is for security research and defensive purposes only
• Always test on systems you own or have explicit authorization for
• The PoC generator creates files that can crash vulnerable systems
• Keep your test environment isolated from production networks