The Price of Compatibility: Defeating macOS Kernel Using Extended File Attributes
summary
Finds two macOS kernel flaws in the FAT compatibility layer that parses AppleDouble ._ files, turning malformed extended-attribute headers into an out-of-bounds read and an out-of-bounds slab write. Uses source audit and a timed exploit that writes a 64 MB xattr dump to enlarge a file write window, precise kernel-heap grooming of ipc_key_message objects to create a UAF, and converts primitives to arbitrary kernel read/write and privilege escalation. Demonstrates reproducible zero‑click panic on mount, provides exploit code, and notes iOS is not affected; fix ships in macOS 10.15.2.
AI-written summary · about
chapters (28)
- 0:00Intro
- 0:30Who am I
- 1:10Agenda
- 1:56Finder
- 2:35File
- 3:25XML
- 5:03Disk Utility
- 5:35File System
- 7:18xctr
- 7:39AmpleFile
- 8:09File Parsing
- 9:25Code Audit
- 10:43The Problem
- 13:42Memory Disclosure
- 14:41Location Kernel
- 15:22Kernel Privilege Exclusion
- 17:21What can ob slam do
- 19:52Ob slam side effects
- 22:57Perfect UAF
- 25:54Slapback Operation
- 28:14Exploit Strategy
- 29:12Key erqc
- 29:58Impact on iOS
- 31:47The vulnerability
- 33:13Exploit process
- 34:18Flash drive attack
- 35:06File C vulnerability
- 36:08Outro
related talks
25mThe Last Line of Defense: Understanding and Attacking Apple File System on iOS
26mDive into Apple UserFS (Userspace Filesystem)
37mAttacking The XNU Kernel In El Capitain
33mA Deep Dive into A Vulnerability Apple Deems Unexploitable
40m(P)FACE into the Apple core and exploit to root
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
43mDebug for Bug: Crack and Hack Apple Core by Itself
57mExploring Yosemite: Abusing Mac OS X 10.10