Racing the Dark: A New TOCTTOU Story From Apple's Core
summary
Researcher presents more than a dozen macOS kernel memory-mapping zero-days and traces how weak input validation and mapping rules create TOCTTOU and non-traditional double-fetch bugs. Tools include a homegrown k-mong kernel hook framework, sniffers/fuzzers and a kernel address sanitizer; around 18 Wi‑Fi and 23 Bluetooth kernel bugs are cited. A GPU bug patched as CVE‑2020‑27914 is shown bypassable with a local PoC that crashes macOS Big Sur 11.3 beta (build 20E5217a).
AI-written summary · about
chapters (4)
- 0:00Start
- 7:37The complete process of exploitation
- 9:30Summary of Linux platform
- 11:26Windows kernel routines
related talks
45mD1T1 - How to Analyze and Find Bugs in MacOS and iOS Kernel Drivers
43mDebug for Bug: Crack and Hack Apple Core by Itself
50mFinding Vulnerabilities In iOS/MacOS Networking Code
53mResearching New Attack Interfaces On iOS And OSX
40mKnockout Win Against TCC - 20+ NEW Ways to Bypass Your MacOS Privacy Mechanisms
53mUnderstanding TOCTTOU in the Windows Kernel Font Scaler Engine
36mmacOS Vulnerabilities Hiding in Plain Sight
01h 16mClassic Vulnerabilities