macOS Kernel wait_for_namespace_event() Race Condition / Use-After-Free
Posted by deepcore on December 19, 2019 – 8:13 pm
In the macOS kernel, the XNU function wait_for_namespace_event() in bsd/vfs/vfs_syscalls.c releases a file descriptor for use by userspace but may then subsequently destroy that file descriptor using fp_free(), which unconditionally frees the fileproc and fileglob. This opens up a race window during which the process could manipulate those objects while they’re being freed. Exploitation requires root privileges.
Post a reply
You must be logged in to post a comment.