XNU heap exploitation: From kernel bug to kernel control | Tihmstar | NULLCON Goa 2020

This talk explores the exploitation of two kernel vulnerabilities, CVE-2018-4344 and CVE-2019-6225, by presenting three kernel exploits: treadm1ll, v1ntex, and v3ntex. It begins with a brief introduction to the XNU internals, specifically focusing on Mach ports and heap allocators like zalloc and kalloc. The speaker demonstrates the progression from proof of concept to fully developed kernel exploit, emphasizing the exploitation techniques and the manipulation of heap memory. Additionally, the talk considers changes between iOS versions 11 and 12 that affect the exploitation process, highlighting that even minor modifications to the exploit chain can lead to significant impacts.