Attacking iPhone XS Max

Overview: T L A Wong of Team Pangu presents an in-depth vulnerability analysis and exploitation walkthrough targeting the Apple iPhone XS Max on iOS 12. The presentation explores a race condition in the XNU kernel's Unix domain socket implementation that can be transformed into a reliable kernel Use-After-Free (UAF) primitive. Wong details the architectural root cause within socket binding routines, explains the broader emergence of the "temporary unlock" vulnerability pattern across kernel modules, and analyzes the impact of hardware-enforced Pointer Authentication Codes (PAC) on Apple's A12 Bionic processor.

Key Topics: - Unix domain socket architecture in the XNU kernel (`socket`, `unp_pcb`, and `vnode` data structures) - Race condition mechanics arising from temporary mutex unlocks during `vnode` allocation in `unp_bind` - Construction of a kernel Use-After-Free (UAF) condition via `unp_connect` and dangling `v_socket` pointers - Recurring kernel concurrency flaws caused by temporary unlocks and Apple's remediation in iOS 12.2

Technical Details: In the XNU kernel, Unix domain sockets facilitate local interprocess communication. Creating a socket initializes a `socket` structure and an associated `unp_pcb` (UNPCB) structure, which cross-reference each other through `so_pcb` and `unp_socket` pointer members. When an application binds the socket to a filesystem path via `bind()`, the system call invokes `unp_bind()`. This function creates a filesystem `vnode` of type `Vsock`, linking `unp_pcb->unp_vnode` to the new `vnode` and setting `vnode->v_socket` back to the socket. Because `vnode` allocation involves filesystem I/O, `unp_bind()` drops the socket lock temporarily to avoid holding locks during expensive operations.

This temporary unlock introduces a critical concurrency race. If an unprivileged user spawns two threads that concurrently call `bind()` on the same socket using two different filesystem paths, both threads can enter `unp_bind()` simultaneously. Consequently, two distinct `vnode` objects are allocated, each with its `v_socket` field referencing the identical socket structure. However, the socket's `unp_pcb` only stores a pointer to one of these vnodes. When the process closes the socket, `so_close()` executes cleanup logic, deallocating the `socket` and `unp_pcb` structures and clearing the back-pointer on the referenced `vnode`. The orphaned second `vnode` remains in the filesystem with a dangling `v_socket` pointer addressing freed kernel memory.

An attacker triggers a Use-After-Free by invoking `connect()` on another socket targeting both bound paths. The kernel routine `unp_connect()` looks up the filesystem path, retrieves the orphaned `vnode`, confirms it is a `Vsock`, and dereferences its dangling `v_socket` pointer into `socket_lock()`. Wong highlights that this temporary unlock pattern is not isolated to networking; similar race flaws were disclosed by Ian Beer in XNU VM copy operations and Adam Donenfeld in IOKit/IOSurface. Apple fixed the vulnerability in iOS 12.2 without a public CVE by re-checking whether `unp_pcb->unp_vnode` is non-null immediately after reacquiring the socket lock in `unp_bind()`.

Key Takeaways: Temporary unlock optimizations introduced to minimize lock contention during long-running I/O operations represent a severe bug pattern that frequently leads to kernel race conditions and use-after-free vulnerabilities. Kernel engineers must ensure that any temporary drop of synchronization primitives is paired with rigorous state re-validation upon lock re-acquisition. For security researchers, auditing kernel code paths where locks are released across memory or object allocations provides an effective methodology for discovering high-impact privilege escalation primitives.

(AI summary — Gemini Flash)