Dive into Apple UserFS (Userspace Filesystem)

on YouTube ↗26m

" summary

Apple moves FAT/exFAT handling into a user-space framework where a USB mount flows: lockd triggers UserFSD, UserFSD calls UVFS service which loads plugins and delegates to Live File Provider D and the userland tool mount_lif_fs; kernel RIFS forwards syscalls to user space via Mach messages (notably message ID 0x285) with per-request IDs. Reverse engineering finds XATTR offset checks missing, allowing attribute-overwrite primitives; a one-bit overwrite primitive yields a root shell on macOS 10.10.1 and the bug affects iOS <16.2 (CVE-2022-42861 related).

AI-written summary · about

" chapters (10)

1. 0:00Introduction
2. 2:18What is Apple UserFS
3. 7:58Mounting UserFS volumes
4. 12:24Accessing files via UserFS
5. 15:34UserFS vulnerabilities
6. 21:04Exploiting UserFS for kernel attacks
7. 22:12Filesystem security changes
8. 23:41Advantages and disadvantages of UserFS
9. 24:46UserFS performance impact
10. 25:08Conclusion

" related talks

• 36mThe Price of Compatibility: Defeating macOS Kernel Using Extended File AttributesZuozhi Fan · Black Hat Asia 2021
• 25mThe Last Line of Defense: Understanding and Attacking Apple File System on iOSXiaolong Bai, Min (Spark) Zheng · Black Hat Europe 2018
• 29mFilesystem mounts in user namespacesChristian Brauner · Container Camp UK 2018
• 40m(P)FACE into the Apple core and exploit to rootMoony Li, Jack Tang · CODE BLUE 2016
• 53mResearching New Attack Interfaces On iOS And OSXMoony Li, Lilang Wu · HITBSecConf 2019 Amsterdam
• 33mA Deep Dive into A Vulnerability Apple Deems UnexploitableMickey Jin · Nullcon Berlin 2025
• 50mRo(o)tten Apples: Vulnerability Heaven in the iOS SandboxAdam Donenfeld · Black Hat Europe 2017
• 16mA file system for safely interacting with untrusted USB flash drivesSebastian Angel, Ke Zhong, Zhihao Jiang, Ke Ma · 12th USENIX Workshop on Hot Topics in Storage and File Systems (HotStorage '20)