MOAB-12-01-2007: Apple DMG UFS ufs_lookup() Denial of Service Vulnerability

A specially crafted UFS filesystem in a DMG image can cause the ufs_lookup() function to call ufs_dirbad() when a corrupted directory entry is being read, leading to a kernel panic (denial of service).

For further information:

• Apple DMG UFS ufs_lookup() Denial of Service Vulnerability
• Proof of concept: MOAB-12-01-2007.dmg.gz

We would like to thank evan1138 for his generous donation to the project, as well as his constructive feedback and comments.