macOS forensic artifact stream incoming.

Not "possibly the biggest". THE Biggest. Congratulations to @axi0mx! Thankfully AAPL eventually patched this - the stuff Cellebrite , Grey key etc base their entire business model on. For researchers,this is a great boon:Brings back tethered, JB&opens up dual boot, for life! twitter.com/axi0mX/status/…

We hacked our way to executing an interactive bash shell on iOS on QEMU. We based the research on the work done by @zhuowei. Thanks! alephsecurity.com/2019/06/17/xnu…

No wait, code has to be on flash (Harvard architecture strikes again!). So, ROP to rewrite the flash..? 😃

No MMU - is ROP necessary?

Also haven’t been on a network of more than a dozen devices all trying to do the same update. Caching proxy is so much simpler than going down a WSUS-like route.

Right, your argument is that if you can corrupt sa_len with another bug, before the CONNECTED event, the callback registered in mptcp_subflow_add (fergofrog.com/code/cbowser/x…), will trigger the overflow. Not bad, but if you have a memory corruption there are definitely better targets

You're referring to this "flow" twitter.com/userlandkernel…? Seems to be from brightiup.me/QuartzCore/Fun… a very cool, yet unrelated, exploit for CVE-2018-4415.

Unless there's a driver that happily passes sockaddr's from userland into mptcp straight through mptcp_connectx, rather than mptcp_usr_connectx, this is not an exploitable bug. Definitely doesn't require additional checks to be added, or a CVE to be assigned.

Finally mptcp_check_subflows_and_add, either passes a fixed length dst struct, or one from mpte->mpte_dst, which is set from fergofrog.com/code/cbowser/x…, which is our dear friend from before, mptcp_usr_connectx, which checks sa_len.

mptcp_subflow_connected_ev operates on the CONNECTED event, called at fergofrog.com/code/cbowser/x…. The mpts->mpts_dst, however, only has uses in two other functions mptcp_subflow_add (the function in question) and fergofrog.com/code/cbowser/x… (does check sa_len).

Makes it very easy to verify @s1guza/@NedWilliamson's points regarding @RazMashat/@userlandkernel's unexploitable bug. From fergofrog.com/code/cbowser/x… there are 3 uses. For the simple case, the sa_len is checked at fergofrog.com/code/cbowser/x… (mptcp_usr_connectx).

Updated the XNU code browser to xnu-4903.221.2. fergofrog.com/code/cbowser/x…

I've released an updated guide on compiling xnu 4903.221.2 (macOS 10.14.1) for arm64. No code changes required this time - thanks Apple! blog.fergofrog.com/xnu/arm64/2018…