task_t considered harmful

Summary: Project Zero's Ian Beer described a design flaw in the XNU kernel behind iOS and macOS in which IOKit user clients store an owningTask pointer without taking a reference, leaving a dangling task_t that can be reused by a privileged process after the original task exits. Beer built a working exploit against IOSurfaceRootUserClient that maps and writes another process's memory, overwrites the __cleanup pointer in libc, and runs a ROP chain to call setuid(0) and execve /bin/bash, noting Apple shipped two rounds of mitigations followed by a large refactor in macOS 10.12.1 and iOS 10.1.
Bottom line: The bug is reachable from inside the Safari renderer and Chrome GPU sandboxes, so a sandbox escape to root required no kernel memory corruption - just a lifetime assumption that kernel extension developers, including Apple's own sample kext, got wrong.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026