A Year of Fuzzing XNU Mach IPC Uncovers Kernel Vulnerabilities

Summary

A researcher presents a template-based fuzzer for XNU Mach IPC, using generated C tests, mutation strategies and kernel-panic monitoring. The talk details kernel vulnerabilities and says Apple patched one in iOS 15.6.1.

Key points

• The presenter analyzes XNU Mach IPC bugs, including a type-confusion issue and a user-data element use-after-free, and describes fixes involving checks or locking.
• A template-based fuzzer combines structured test cases with annotated C templates to generate executable Mach IPC test programs.
• Its mutator changes function arguments and call order, applies function-specific probabilities, and targets edge cases to improve kernel code coverage.
• A harness records each running test case and monitors Mac OS virtual machines for kernel panics through serial consoles.
• The detailed vulnerability involved unchecked indexing in IPC request handling and overlapping union fields; crafted Mach messages could corrupt kernel memory.
• The presenter says he reproduced the issue on an iPhone 11 running iOS 15.6 and that Apple released a hotfix in iOS 15.6.1.
• The talk recommends combining fuzzing with code auditing and a strong understanding of the target.