Attacking The XNU Kernel In El Capitain
summary
Demonstrates a working El Capitan kernel exploit that bypasses System Integrity Protection by adapting the old vm_map_copy corruption to the new structure, using the XNU zone allocator and a measurable zone-timing trick to create deterministic adjacent allocations. Builds an overlap between a corrupted vm_map_copy and an OSData object to leak the KASLR slide and gain controlled reads/writes, then leverages a use‑after‑free virtual call to jump to a kernel CSR function and disable SIP, with a recorded demo showing the exploit working on the patched machine version.
AI-written summary · about
chapters (4)
- 0:00Start
- 9:59The XNU Heap: vm_map_copy in 10.11
- 11:30Leaking heap pointers in 10.11
- 12:26Leaking arbitrary memory in 10.11
related talks
37mEternal War in XNU Kernel Objects
36mThe Price of Compatibility: Defeating macOS Kernel Using Extended File Attributes
35mAttacking iPhone XS Max
57mExploring Yosemite: Abusing Mac OS X 10.10
53mXenpwn: Breaking Paravirtualized Devices
54mSubverting Apple Graphics: Practical Approaches to Remotely Gaining Root
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
41mUsing Microarchitectural Design to Break KASLR and More