CVE-2009-1238 describes a race condition in the HFS vfs sysctl interface within Apple Mac OS X 10.5.6 and earlier, specifically in XNU 1228.8.20 and earlier. This flaw allows a local attacker to trigger a denial of service through kernel memory corruption by simultaneously executing the HFS_SET_PKG_EXTENSIONS code path in multiple threads, due to a lack of mutex locking for a global variable. With a CVSS score of 7.2, this vulnerability is considered highly severe, requiring local access but having low attack complexity, and potentially leading to complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or Metasploit/Nuclei modules, a Proof-of-Concept exploit is available on ExploitDB, and the CVE has received minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 10.5.6CPE matchmatch criteria | cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:apple:mac_os_x:10.0:*:*:*:*:*:*:* | ||
10.0.0CPE matchmatch criteria | cpe:2.3:o:apple:mac_os_x:10.0.0:*:*:*:*:*:*:* | ||
10.0.1CPE matchmatch criteria | cpe:2.3:o:apple:mac_os_x:10.0.1:*:*:*:*:*:*:* | ||
10.0.2CPE matchmatch criteria | cpe:2.3:o:apple:mac_os_x:10.0.2:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:L/AC:L/Au:N/C:C/I:C/A:C
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.5 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.