Description
The queueing primitives in IOMobileFrameBuffer in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 do not properly perform type conversion, which allows local users to gain privileges via a crafted application.
References
- http://support.apple.com/kb/HT4803
- APPLE-SA-2011-07-15-1 vendor-advisory
- APPLE-SA-2011-07-15-2 vendor-advisory
- http://support.apple.com/kb/HT4802