A buffer overflow in the XNU kernel

[lgdskhglsa]

In case people missed it, the name of the exploit is a blink 182 song released around the time it was discovered.

[jprx]

You get it!!

[bartvk]

If you're still running the affected kernel, what are the possible consequences?

Also, this has been public for months:

- February 17, 2024: I posted the hash of TURPENTINE.c to X on Feb 17, 2024.

- May 13, 2024: macOS Sonoma 14.5 (23F79) shipped with xnu-10063.121.3, the first public release containing a fix.

[axoltl]

The syscalls involved are in a lot of sandboxes, so worst (or best, depending on your point of view) case scenario it's a pretty universal privesc. There's a lot of steps to get there though. I'm not super familiar with the mbuf subsystem specifically but I'm going to guess mbufs are in their own allocator zone. That means you're guaranteed to overwrite an adjacent m_hdr structure. Those contains pointers that form a linked list and at first glance I don't see linked list hardening or zone checks in the MBUF macros. One could envision being able to turn this bug into a kASLR leak as well as a kernel r/w primitive and while that isn't the silver bullet it used to be on XNU (because of a whole host of hardening Apple put in) it's still pretty powerful.

[TheDong]

> Also, this has been public for months:

Posting the hash to twitter as a proof that "something" exists reveals no actual information, so it's not considered making the exploit "public" in any meaningful way.

From the blog's timeline, it's been visible in code diffs since ~April, but only called out as a CVE since 10 days ago, so I'd consider this one hot off the presses.

[chad1n]

There is a bigger chance that a toddler smashing a keyboard finds a bug than gpt5. LLMs can't understand intent, so they literally work like `grep` with little to no understanding of the context, so most of the time it will false flag good code.

There are already a lot of tools already to find bugs, like fuzzers, but I am sure that LLMs won't be one of them.

[lpapez]

Writing an exploit is usually much more difficult than patching the underlying bug.

Half of the work in fixing a bug report is getting a reproducible example. Nay, more than half.

If there was a magic AI which could generate exploits, I'd imagine there would be an equally magic AI patching the holes right out.

[saagarjha]

It’s definitely nowhere near capable of doing that.

[mschuster91]

> Like when you can just send one icmp packet with `+++ath0` and just disconnect someone's modem

Oh, I remember the "XDCC SEND KEYLOGGER 0 0 0" exploit from IRC era ~2010... dumbass middleboxes would yeet anyone whose packets crossed them.

[jiveturkey]

the real win will be when it can also generate the codename for the exploit. FATEFATAL