Splitting atoms in XNU
Summary: Google Project Zero's Ian Beer detailed a locking bug in the XNU virtual memory subsystem where vm_map_copyin_internal drops and retakes the source map lock, letting two threads both apply the optimized move to the same anonymous vm_map_entry and create shared memory that mach message semantics say cannot exist. That shared memory produced a time-of-check-time-of-use heap overflow in XPC, which he chained into a jump-oriented payload in an unsandboxed root process on iOS 12.0 on iPhone Xs despite ARM Pointer Authentication Codes, then used a privileged socket to pass a file descriptor back into the sandbox for a kernel heap overflow.
What you should know: The exploit defeated PAC, Apple's newest hardware mitigation on the A12 chip, by chaining arbitrary function calls in an unsandboxed root process - a reminder that a single lock dropped and retaken in kernel code can undo a hardware defense.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026