Sock Puppet: A Walkthrough of a Kernel Exploit for iOS 12.4

Summary: Project Zero's Ned Williamson published a walkthrough of CVE-2019-8605, a use-after-free in the XNU kernel present as early as 2013 that he reported to Apple in March 2019 and that was patched in iOS 12.3 in May 2019. The bug regressed in iOS 12.4 and was patched again in iOS 12.4.1 in late August 2019; the exploit, named SockPuppet, achieves arbitrary kernel read and free, and Williamson found it by seeding a protobuf-based network fuzzer with two prior bug reports.
What's compelling: A kernel flaw that sat in XNU for five years, was patched, and then regressed into a shipped iOS release shows that a fix is not the same as a durable fix - and the primitive here yields arbitrary kernel read and free with very little work.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2019-8605
Related: CVE-2019-8605: Apple Multiple Products Use-After-Free Vulnerability Known Exploited Vulnerabilities · Jun 27, 2022
Designing sockfuzzer, a network syscall fuzzer for XNU Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026