XNU DevFS Logic Bug Enabled macOS Root Access and SIP Bypass
· 27:18 · Watch on YouTube ↗
Summary
A researcher demonstrated a DevFS time-of-check/time-of-use flaw in XNU that let an unprivileged macOS user gain root and bypass System Integrity Protection. Apple fixed the flaw in macOS 12.6.6 and iOS 16.5.
Key points
- The research examined XNU's DevFS handling, where path-based operations and file-descriptor-based vnode attributes interacted.
- In the demonstrated race, a file descriptor could be changed between permission checks and an attribute update, causing the update to apply to a different file.
- The flaw let an unprivileged user change a root-owned file's mode and make it setuid, providing a route to root access.
- The same bug could bypass System Integrity Protection controls on protected files and kernel-extension policy data; loading an extension still required it to be correctly signed.
- The presenter said the exploit ran in an x86 virtual machine with its reported machine identity changed to appear as an M1 Mac; the exploit itself was real.
- Apple fixed the issue in macOS 12.6.6 and iOS 16.5. The presenter noted that the relevant code was not compiled into iOS release kernels.
Article Details
- Topics
- [01:27] macOS kernel-exploitation target and research constraints
- [04:46] XNU file-system attack surface and vnode behavior
- [10:05] DevFS file-descriptor paths and vnode attribute handling
- [14:59] TOCTOU race enabling file-mode changes and root escalation
- [17:12] Using the flaw to bypass System Integrity Protection controls
- [23:29] Apple fixes and the speaker's caveat about iOS release kernels