Abstract

As more and more mitigations have been introduced into Apple devices, many bugs in XNU Kernel, which is well known for the UAF and Type Confusion bugs, become unexploitable. So the drivers will be a much more valuable target than before.

After checking a lot of pocs in driver, an idea of building a Hybrid Fuzzer to combine code audit and fuzzing together suddenly came to my mind. This talk will first introduce the newly added mitigations, and then cut into the idea and detail of two tiers hybrid fuzzing. The first tier will do the lightweight fuzzing to collect all reachable services in the system and generate a plist for second tier to do enhanced fuzzing based on code audit. Several bugs had been found in this way, such as CVE-2021-30923/CVE-2022-22661/CVE-2022-32814 and over 15+ DOS bugs, and there are also other critical bugs on the way to fix for iOS 16.x/macOS 13.x.

In this talk, I will also cover in details about some unpublic bug found by the fuzzer and the future plan of it. Then I will also share how to use one of them 100% stable leaking the kernel slide on macOS 13, regardless of the powerful random mitigations. This is also an interesting infoleak attack surface that had not been talked about before.