The Price of Compatibility - Defeating macOS Kernel Using Extended File Attributes

This course analyzes vulnerabilities in macOS extended file attribute handling and FAT filesystem compatibility code. It explains how crafted filesystem data can trigger kernel memory corruption and enable attacks.

Syllabus

Intro
Who am I
Agenda
Finder
File
XML
Disk Utility
File System
xctr
AmpleFile
File Parsing
Code Audit
The Problem
Memory Disclosure
Location Kernel
Kernel Privilege Exclusion
What can ob slam do
Ob slam side effects
Perfect UAF
Slapback Operation
Exploit Strategy
Key erqc
Impact on iOS
The vulnerability
Exploit process
Flash drive attack
File C vulnerability
Outro