Privileged Code Execution via Kernel Memory Corruption in Apple OSes

This repository contains a single C proof-of-concept exploit (CVE-2018-4150.c) and a brief README. The exploit targets a race condition in Apple's BPF (Berkeley Packet Filter) device implementation, specifically by racing the BIOCSDLT and BIOCSBLEN ioctls to cause a buffer overflow. The code is designed to work on iOS up to version 11.2.6 and likely affects macOS as well. The exploit works by opening /dev/bpf3, setting up a raw IPv6 socket, and using multiple threads to race the buffer length setting, eventually allowing the sending of an oversized packet to the loopback address. The repository is a functional proof-of-concept and does not include a weaponized payload or privilege escalation code, but demonstrates the vulnerability and its exploitation. The main entry point is CVE-2018-4150.c, written in C, and the attack vector is local, requiring access to the BPF device and raw sockets.

This repository contains a single exploit file (exploit.m) and a license. The exploit targets CVE-2018-4150, a race condition in the BPF device on macOS and iOS (up to iOS 11.2.6, pre-iPhone 7). The exploit is written in Objective-C and is designed to be run locally on a vulnerable device. It works by racing two threads to exploit a bad locking bug in the BPF device, causing a heap overflow. The exploit then sends a crafted packet to the default router IP (192.168.0.1) to trigger the overflow, leaks the kernel base address, and provides an early kernel read primitive. The code is a proof-of-concept and does not provide a full privilege escalation or shell, but it lays the groundwork for further exploitation. The repository is well-commented, explaining each step of the exploit process, and is intended for research and development of further kernel exploits.