Something from Nothing - Exploiting Memory Zeroing in XNU

Ian Beer, a Google Project Zero researcher, walks through a little-known flaw in the XNU virtual memory subsystem that lets an unprivileged process zero out pages it should only be able to read. He starts with a simplified model of the layers involved, from the VM map and its entries down to VM objects and the pmap level, and explains why design intent matters when hunting for omission errors and misused internal APIs.

The core of the talk is the search for the bug. Beer reviews the pmap page-clearing routines and traces one caller that clears wired pages when a behavior flag is set on a mapping. That flag can be set through a public Mach call without any write-permission check, so a read-only file mapping can be wiped and then freed. Apple's initial response suggested the impact was limited, which Beer disputes. He then surveys other possible targets, such as blacklists, configuration files, certificate stores and executable code, before settling on a shared-cache service.

The final stretch shows a working route to root. Beer zeroes pages of a shared-cache service so that an authorization call becomes an XPC dictionary set-value call with attacker-controlled arguments, then uses heap spraying and an empty dictionary key to gain control of execution. He closes by noting that the flag appears never to have been used and suggesting that similar primitives may matter more in a world with memory tagging.