81 matches found
EUVD-2013-3887
Malware in sbrugna...
EUVD-2007-4668
Malware in sbrugna...
PT-2025-3034 · Apple · Xnu Kernel +3
Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.2 iOS versions prior to 18.2 iPadOS versions prior to 18.2 Description: A type confusion issue was addressed with improved memory handling. An attacker with user privileges may be able to read kernel memory due to...
Exploit for Out-of-bounds Write in Apple Ipados
CVE-2024-27815 XNU kernel buffer overflow. Introduced in xnu...
PT-2024-13027
Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 17 Apple iPadOS versions prior to 17 Apple macOS versions prior to 14 Description This issue involves a use-after-free condition addressed through improved memory management. A malicious application may potentially...
Exploit for Race Condition in Apple Safari
MacDirtyCow Example of CVE-2022-46689 aka MacDirtyCow. Wh...
The vulnerability of the XNU kernel in Apple iOS and Mac OS systems allows attackers to escalate their privileges or execute arbitrary code.
The vulnerability of the XNU kernel in Apple’s iOS and Mac OS systems is related to type conversion errors. Exploiting this vulnerability can allow attackers to enhance their privileges or execute arbitrary code by running a specially created application...
Designing sockfuzzer, a network syscall fuzzer for XNU
Posted by Ned Williamson, Project Zero Introduction When I started my 20% project – an initiative where employees are allocated twenty-percent of their paid work time to pursue personal projects – with Project Zero, I wanted to see if I could apply the techniques I had learned fuzzing Chrome to...
The core of Apple is PPL: Breaking the XNU kernel's kernel
Posted by Brandon Azad, Project Zero While doing research for the one-byte exploit technique, I considered several ways it might be possible to bypass Apple's Page Protection Layer PPL using just a physical address mapping primitive, that is, before obtaining kernel read/write or defeating PAC...
iOS, iPadOS, tvOS, watchOS, and macOS contain a double-free vulnerability in the XNU kernel lio_listio() function
Overview iOS, iPadOS, tvOS, watchOS, and macOS contain a double-free vulnerability in the GNU kernel's liolistio function, which can allow a malicious application to achieve unsandboxed, kernel-level code execution. Description iOS, iPadOS, tvOS, watchOS, and macOS contain an a double-free...
The vulnerability in the XNU kernel of iOS, Mac OS, and TV OS allows attackers to perform unauthorized changes to the memory shared among processes.
The vulnerability of the XNU-based operating systems such as iOS, Mac OS, and TV OS is related to errors in the memory initialization mechanism. Exploiting this vulnerability allows an attacker to perform unauthorized changes to the memory shared among processes, using specially crafted executabl...
Project Zero Discloses High-Severity Apple macOS Flaw
Researchers have disclosed what they say is a high-severity security flaw in Apple’s MacOS operating system – which has not yet been patched. The flaw gives an attacker privileges to perform malicious actions on a mounted filesystem – without the victim knowing. The Google Project Zero team...
XNU Kernel iOS / macOS heap buffer overflow Exploit
The vulnerability is a heap buffer overflow in the networking code in the XNU operating system kernel. XNU is used by both iOS and macOS, which is why iPhones, iPads, and Macbooks are all affected. My exploit PoC just overwrites the heap with garbage, which causes an immediate kernel crash and...
XNU kernel heap overflow due to bad bounds checking in MPTCP(CVE-2018-4241)
mptcpusrconnectx is the handler for the connectx syscall for the APMULTIPATH socket family. The logic of this function fails to correctly handle source and destination sockaddrs which aren't AFINET or AFINET6: // verify salen for AFINET: if dst-safamily == AFINET && dst-salen !=...
XNU Kernel - Heap Overflow Due to Bad Bounds Checking in MPTCP
mptcpusrconnectx is the handler for the connectx syscall for the APMULTIPATH socket family. The logic of this function fails to correctly handle source and destination sockaddrs which aren't AFINET or AFINET6: // verify salen for AFINET: if dst-safamily == AFINET && dst-salen !=...
XNU Kernel - Heap Overflow Due to Bad Bounds Checking in MPTCP
XNU Kernel - Heap Overflow Due to Bad Bounds Checking in MPTCP mptcpusrconnectx is the handler for the connectx syscall for the APMULTIPATH socket family. The logic of this function fails to correctly handle source and destination sockaddrs which aren't AFINET or AFINET6: // verify salen for...
XNU Kernel - Heap Overflow Due to Bad Bounds Checking in MPTCP Exploit
Exploit for multiple platform in category dos / poc mptcpusrconnectx is the handler for the connectx syscall for the APMULTIPATH socket family. The logic of this function fails to correctly handle source and destination sockaddrs which aren't AFINET or AFINET6: // verify salen for AFINET: if...
Apple macOS XNU Kernel - Memory Disclosure due to bug in Kernel API for Detecting Kernel Memory Disclosures
/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1372 the kernel libproc API proclistuptrs has the following comment in it's userspace header: / Enumerate potential userspace pointers embedded in kernel data structures. Currently inspects kqueues only. NOTE: returned "pointers"...
Apple macOS XNU Kernel - Memory Disclosure due to bug in Kernel API for Detecting Kernel Memory Disclosures
Apple macOS XNU Kernel - Memory Disclosure due to bug in Kernel API for Detecting Kernel Memory Disclosures / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1372 the kernel libproc API proclistuptrs has the following comment in it's userspace header: / Enumerate potential...
Apple MacOS 32-Bit Syscall Exit Kernel Register Leak(CVE-2017-2509)
The XNU kernel, when compiled for a x86-64 CPU, can run 32-bit x86 binaries in compatibility mode. 32-bit binaries use partly separate syscall entry and exit paths. To return to userspace, unixsyscall in bsd/dev/i386/systemcalls.c calls threadexceptionreturn in osfmk/x8664/locore.s, which in turn...