Designing sockfuzzer, a network syscall fuzzer for XNU

Summary: Google Project Zero's Ned Williams built sockfuzzer, a fuzzer that ports XNU's networking stack into userland as a library and calls syscalls like connectx directly alongside injected packets via ip_input and ip6_input. The project reproduced peers' recent findings and surfaced its own, including CVE-2019-8605, a reliable privilege escalation from the app context dubbed "SockPuppet."
Why it matters: The kernel many in the iOS research community considered "fuzzed to death" yielded a reliable app-context privilege escalation once networking syscalls and packet input were fuzzed together, which is the kind of bug that undermines the assumption that a well-tested attack surface is a closed one.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2019-8605
Related: CVE-2019-8605: Apple Multiple Products Use-After-Free Vulnerability Known Exploited Vulnerabilities · Jun 27, 2022
Sock Puppet: A Walkthrough of a Kernel Exploit for iOS 12.4 Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026