Finding Vulnerabilities In iOS/MacOS Networking Code
summary
Finds multiple XNU networking bugs in mbuf processing that lead to crashes and were credited as 8 CVEs (including several RCEs). Uses Semmle QL variant analysis and custom dataflow queries to spot unsafe uses of m_getptr/m_copy_data and bcopy, then implements PoCs: raw-socket packets that trigger TCP/IP option overflows, an RPC-gen fake NFS server that sends oversized filehandles, and kernel-level write paths that cause infinite-loop DoS or stack/heap overflows. Demos reliably crash or hang macOS/iOS kernels; some issues require special config but several work over Wi‑Fi.
AI-written summary · about
chapters (6)
- 0:00Introduction and background
- 2:30First vulnerability: Packet Mangler
- 13:48Apple’s delayed response and fixes
- 22:22Second vulnerability: NFS client
- 36:24Third vulnerability: ICMP error
- 49:03Future research and closing remarks
related talks
01h 16mClassic Vulnerabilities
35mRacing the Dark: A New TOCTTOU Story From Apple's Core
43mDebug for Bug: Crack and Hack Apple Core by Itself
45mD1T1 - How to Analyze and Find Bugs in MacOS and iOS Kernel Drivers
34mTowards Discovering Remote Code Execution Vulnerabilities in Apple FaceTime
37mEternal War in XNU Kernel Objects
42mDiscovering and Exploiting Novel Security Vulnerabilities in Apple ZeroConf
33mA Deep Dive into A Vulnerability Apple Deems Unexploitable