CVE-2024-54507

SUSCTL: CVE-2024-54507 Introducido en xnu-11215.1.10, corregido en xnu-11215.61.5. Informe: https://jprx.io/cve-2024-54507...

xnu

¿Qué es XNU? El kernel XNU es parte del sistema operativo Darwin para su uso en los sistemas operativos macOS e iOS. XNU es un acrónimo de X is Not Unix. XNU es un kernel híbrido que combina el kernel Mach desarrollado en la Universidad Carnegie Mellon con componentes de FreeBSD y una API en C++...

CVE-2023-41992

CVE-2023-41992 Esta es una prueba de concepto para CVE-2023-41992. Y antes que nada, esto no tiene nada que ver con jailbreak. ¡Y todavía está en desarrollo. Gracias a todos los que me han ayudado hasta ahora. Por razones de privacidad, es posible que no los mencione aquí. ¡DM si quieres! parche...

CVE-2018-4407

CVE-2018-4407 CVE-2018-4407 es una vulnerabilidad de desbordamiento de búfer en el código de error ICMP del kernel XNU. Provoca que los dispositivos IOS se bloqueen tanto laptops como móviles al recibir un ¡sí, 1! solo paquete malo. El bug fue divulgado originalmente por Kevin Backhouse en su...

rootsh

rootsh rootsh is a local privilege escalation targeting OS X Yosemite 10.10.5 build 14F27. It exploits CVE-2016-1758 and CVE-2016-1828, two vulnerabilities in XNU that were patched in OS X El Capitan 10.11.4 and 10.11.5. rootsh will not work on platforms with SMAP enabled. CVE-2016-1758...

Trigon

Trigon Trigon is a deterministic kernel exploit based on CVE-2023-32434. It currently supports A9 - A11 devices running iOS 13 - 15.7.6 . Being deterministic means that this exploit will never panic during or after exploitation and is completely reliable. Trigon exploits an integer overflow in th...

CVE-2018-4407-IOS

CVE-2018-4407-IOS CVE ? Common Vulnerabilities and Exposures TLDR The vulnerability is a heap buffer overflow in the networking code in the XNU operating system kernel. XNU is used by both iOS and macOS, which is why iPhones, iPads, and Macbooks are all affected. My exploit PoC just overwrites th...

vpwn

vpwn by qwertyoruiop generic xnu heap overflow exploitation. demo output: $ ./pwn i Preparing payload... i broke out of kaslr, kaslrslide = 0000000001a00000 + Payload successfully crafted. i Manipulating the heap... i Exploit loaded. + got r00t sh-3.2 uname -a Darwin qwertyoruiops-iMac.local 14.3...

MacDirtyCowDemo

Get root on macOS 13.0.1 with CVE-2022-46689 macOS equivalent of the Dirty Cow bug, using the testcase extracted from Apple's XNU source. https://worthdoingbadly.com/macdirtycow/ Usage On a macOS 13.0.1 / 12.6.1 or below machine, run: clang -o switcharoo vmunalignedcopyswitchrace.c sed -e...

MacDirtyCow

MacDirtyCow Example of CVE-2022-46689 aka MacDirtyCow. What? MacDirtyCow is a privilege escalation vulnerability in macOS, similar to the Dirty COW vulnerability in Linux. The vulnerability resides in the copy-on-write COW mechanism used by macOS's XNU kernel. The vulnerability allows an attacker...

CVE-2018-4407

CVE-2018-4407 Massive IOS/MAC Attack Exploit CVE-2018-4407 is a Simple and Very Fast BOF attack Against IOS/MAC that can lead to DOS. The vulnerability is a heap buffer overflow in the networking code in the XNU operating system kernel. XNU is used by both iOS and macOS, which is why iPhones,...

CVE-2024-27815

CVE-2024-27815 XNU kernel buffer overflow. Introduced in xnu-10002.1.13, fixed in xnu-10063.121.3. Writeup: https://jprx.io/cve-2024-27815 gcc TURPENTINE.c -o TURPENTINE ./TURPENTINE Hash $ sha256sum TURPENTINE.c f7160a6ad7d52f32d64b86cf3006c98a217954d80c3fc71a8f27595e227d0fa0 TURPENTINE.c Hash...

AppleDOS

AppleDOS CVE-2018-4407 Basado en CVE-2018-4407 https://lgtm.com/blog/applexnuicmperrorCVE-2018-4407, este tweet y este video. El error es una vulnerabilidad de desbordamiento de montón en el manejo de paquetes maliciosos cuando el sistema operativo intenta enviar un mensaje ICMP que contiene...

SockFuzzer

SockFuzzer: XNU Kernel Fuzzing Framework Project Status SockFuzzer, originally designed as a networking-focused fuzzer for the XNU kernel used in macOS and iOS, has evolved into a comprehensive kernel fuzzing framework. While retaining its original name as a nod to its roots, SockFuzzer now cover...

iOS-Kernel-Crash

CVE-2018-4407 Memory Corruption The vulnerability is a heap buffer overflow in the networking code in the XNU operating system kernel. XNU is used by both iOS and macOS, which is why iPhones, iPads, and Macbooks are all affected. My exploit PoC just overwrites the heap with garbage, which causes ...

slides

Slides Conference| Year| Name| Description ---|---|---|--- Zer0Con| 2023| CodeQL + DTrace = 💧🐞 in XNU| How to find multiple memory disclosures in XNU using CodeQL...

Pishi

Pishi Pishi is a static binary rewriting tool designed to instrument basic blocks in XNU kernel and in arbitrary macOS kernel extensions kexts. for XNU kernel, Pishi allows you to instrument at a function, file, or folder level. For example, you can instrument everything in the /bsd/net/ director...

CVE-2026-65349

CVE-2026-65349 — getattrlist OOB Write in vfsattrpackinternal Component: XNU VFS — vfsattrpackinternal getattrlist syscall Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Out-of-Bounds write to caller buffer Impact: Kernel heap corruption; from kernel conte...

CVE-2026-65330

CVE-2026-65330 — tmpfs setxattr PAC Bypass Component: XNU VFS — defaultsetxattrdoubleagent tmpfs VNOP Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Fixed PAC diversifier in xattr handler pointer signing Impact: PC control from kernel context; full privile...

CVE-2026-20698-PF_ROUTE-Heap-Overflow

CVE-2026-20698 — XNU Kernel Heap Overflow via PFROUTE RTAGENMASK Overview Heap buffer overflow in XNU's routing socket PFROUTE when processing RTAGENMASK in routemsg. Triggers kernel panic from an unprivileged process with no entitlements. CVE : CVE-2026-20698 credited to DARKNAVY Affected : iOS...