Eternal War in XNU Kernel Objects

## Overview

In the presentation **"Eternal War in XNU Kernel Objects,"** Min Zheng (Spark) and teammate Xiaoning from Alibaba discuss the evolution of exploitation techniques and mitigations within Apple's hybrid XNU kernel across iOS and macOS. While Apple introduced mitigations such as Data Execution Prevention (DEP), Kernel Address Space Layout Randomization (kASLR), freelist randomization (iOS 9.2 / macOS 10.11.2), and zone metadata region integrity checks (iOS / OS X 10.11), attackers shifted their attention toward kernel objects that remain vulnerable to manipulation. Specifically, the talk focuses on how attackers leverage `ipc_port` kernel objects via **Mach Port-Oriented Programming (MPOP)** to bypass modern protections.

---

## Mach Port-Oriented Programming (MPOP) Primitives

MPOP systematizes techniques found in public exploits that manipulate Mach ports—represented in kernel space by pointers to `ipc_port` structures (containing fields such as `io_bits`, `io_references`, `io_lock_data`, and `kobject`). By invoking user-mode system calls with manipulated Mach ports, attackers construct four main categories of primitives:

1. **General-Purpose Primitives:** Utilizes standard Mach system calls as originally designed without hijacking control flow. For instance, obtaining rights to privileged host ports (e.g., via `host_processor_set_priv`) allows acquisition of powerful processor set ports. Furthermore, `mach_vm_*` APIs enable full memory manipulation of another process or kernel space once the target task port pointer is obtained. 2. **Querying Primitives:** Abuses system call logic to disclose kernel layout information and defeat kASLR. Examples include: - `mach_port_kobject`: Historically leaked kernel object addresses (used in the Pangu jailbreak; later patched). - `clock_sleep_trap`: Combined with a corrupted `kobject` field pointing to the global system clock, returns `KERN_SUCCESS` on a match, enabling side-channel brute-forcing of kASLR. 3. **Memory Inter-operation & Type-Confusion Primitives:** Enables unauthorized data transfer between kernel and user space: - `pid_for_task`: Retrieves the PID without validating whether the task object is legitimate. By pointing a fake port to a crafted user-space fake task structure, an attacker can read 32 bytes of arbitrary kernel memory at a specific offset (`bsd_info->p_pid`). - Dangling ports: Using APIs like `mach_port_set_context` / `mach_port_get_context` on dangling (freed) ports allows reading or writing a 64-bit value in kernel space. 4. **Arbitrary Code Execution Primitives:** - Hijacking control flow via `clock_get_attributes` by corrupting global function pointers or crafting fake objects (used in the Pegasus APT attack on iOS 9.3.3). - Overwriting C++ virtual method table (`vtable`) pointers inside I/O Kit user clients (`IOUserClient`) to redirect control flow to ROP gadgets.

---

## Case Study: The Yalu OS X Exploit

The speakers walk through the Yalu exploit targeting OS X: - **Vulnerability:** A heap buffer overflow in `mach_port_extract_right_trap` where `kalloc` allocates a buffer sized via an `sd` value read from user space, but `copyin` uses `receipt_size` (a user pointer that can represent a much larger size). - **Exploitation:** The overflow corrupts `ipc_port` pointers inside an array of Mach messages to point to a crafted fake `ipc_port` in user space. - **kASLR Bypass:** Uses `clock_sleep_trap` to brute-force the global system clock address. - **Arbitrary Kernel Read:** Sets `io_bits` to `IKOT_TASK` and configures a fake task offset to read arbitrary 32-bit kernel values using `pid_for_task` without any ROP gadgets. - **Control:** Historically, exploits obtained the `kernel_task` port via `task_for_pid` or `processor_set_tasks`. When iOS 11 blocked resolution of `kernel_task`, Ian Beer's `async_wake` exploit bypassed the restriction by cloning the kernel's `vm_map` reference pointer into a fake task to retain arbitrary read/write via `mach_vm_*`.

---

## Defense: XNU Kernel Object Protector (XKOP)

Because enterprise MacBooks are not forced to upgrade like iOS devices, lack certain hardware protections, and feature looser sandboxing, they are uniquely exposed to APT and MPOP attacks. To defend these systems, the speakers designed **XKOP (XNU Kernel Object Protector)**: - Deployed as a kernel extension (KEXT) that implements inline hooking on critical system calls and performs runtime integrity checks on `ipc_port` kernel objects. - Uses dedicated examiner functions at strategic kernel execution points, working around the functional limitations of standard MACF (Mandatory Access Control Framework) APIs to backport modern security checks to older macOS installations.