CVE-2020-27904 PoC — Apple Kernel 安全漏洞

Source

https://github.com/pattern-f/xattr-oob-swap

Associated Vulnerability

Title:Apple Kernel 安全漏洞 (CVE-2020-27904)
Description:Apple Mac Pro等都是美国苹果（Apple）公司的产品。Apple Mac Pro是一款电脑。Apple MacBook Air是一款笔记本电脑。Apple MacBook Pro是一款笔记本电脑。 Apple Kernel 存在安全漏洞，该漏洞允许应用程序可能能够使用内核特权执行任意代码。以下产品及版本受到影响：Mac Pro (2013 and later), MacBook Air (2013 and later), MacBook Pro (Late 2013 and later), M

Description

Demo exploit code for CVE-2020-27904, a tfp0 bug.

Readme

# xattr-oob-swap

CVE-2020-27904: a tfp0 bug for macOS 10.15.x and below.

Demo exploit code for my [talk](https://www.blackhat.com/asia-21/briefings/schedule/#the-price-of-compatibility-defeating-macos-kernel-using-extended-file-attributes-21799) at BlackHat ASIA 2021.

The vulnerability has been fixed in macOS Big Sur 11.0, and the latest 10.15&10.14 security update.

# Warranty

**Use it on your own risk. This will make you macOS panic.** I build it for security researchers only.

# Current state

Get tfp0. Tested on **macOS 10.15.2 (19C57)**, MacBook Pro with 16 GB RAM.

Fix kheap by yourself. I leave it empty on purpose.

# Credits

* Almost everything starts from oob_timestamp: Brandon Azad (@_bazad)

# License

GPL-3.0 License

# Misc

my twitter [@pattern_F_](https://twitter.com/pattern_F_)

English is hard for me...

英语太难了...

File Snapshot


 [4.0K]  /data/pocs/f29a5feb2e271c2b12a47ac965c125dd5ca36328
├── [4.0K]  exploit-1
│   ├── [7.5K]  apple_double.c
│   ├── [3.8K]  apple_double.h
│   ├── [ 21K]  exploit.c
│   ├── [1.8K]  ipc_port.h
│   └── [ 292]  main.c
├── [ 34K]  LICENSE
├── [  77]  Makefile
├── [4.0K]  mylib
│   ├── [ 20K]  IOSurface_lib.c
│   ├── [ 962]  kapi.h
│   ├── [3.2K]  kapi_memory.c
│   ├── [4.3K]  k_offsets.c
│   ├── [2.5K]  k_offsets.h
│   ├── [4.8K]  k_utils.c
│   ├── [ 516]  k_utils.h
│   ├── [1.8K]  mycommon.h
│   ├── [1.8K]  sys_darwin.c
│   ├── [ 53K]  user_kernel_alloc.c
│   ├── [3.0K]  user_kernel_alloc.h
│   ├── [6.7K]  utils.c
│   └── [ 938]  utils.h
├── [ 856]  README.md
└── [ 510]  run-exploit.py

2 directories, 22 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!