Dillon Franke

The issue involves a double free condition addressed through improved memory management. This could allow an application to cause unexpected system termination. The issue resides within the `coreaudiod` component of the CoreAudio framework. A proof-of-concept (PoC) has been released demonstrating how the issue can be exploited. The vulnerability could potentially allow an attacker to execute arbitrary code with elevated privileges, leading to a full system compromise.

A logic issue was addressed with improved checks. This issue allows an application to potentially execute arbitrary code with kernel privileges.

The issue is related to the bypass of authentication via spoofing, allowing a remote attacker to compromise IoT devices and gain unauthorized access to protected information. An attacker can impersonate an arbitrary ThroughTek (TUTK) device given a valid 20-byte uniquely assigned identifier (UID), potentially resulting in the hijacking of a victim's connection and forcing them to supply credentials needed to access the victim TUTK device. It is estimated that 83 million devices connected to the Kalay network are at risk. The vulnerability can be exploited to gain access to streaming video and audio, compromise home networks and credentials, and create botnets from compromised devices.