Kernel Privilege Escalation in Apple OSes (CVE-2022-32947)

This repository contains a full exploit chain for CVE-2022-32947, a vulnerability in the Apple GPU driver on macOS 13.0 beta 5 (Apple Silicon). The exploit is implemented in C, Objective-C, and Metal shading language, and is organized under the 'demo_exploit' directory. The main entry point is 'demo_exploit/main.c', which orchestrates the attack in several stages: 1. It initializes the GPU and Metal environment using Objective-C code in 'runner.m'. 2. Stage 1 exploits the GPU to gain access to a page table, using Metal compute shaders ('shaders.metal'). 3. Stage 2 maps all physical memory as read/write, allowing arbitrary kernel memory access. 4. The exploit locates the kernel base and page tables, then walks the kernel's process list to find its own process structure. 5. It overwrites the process credentials in kernel memory to set UID and GID to 0 (root). 6. Finally, it spawns a root shell ('/bin/sh') as proof of successful privilege escalation. The exploit is highly technical and targets a specific macOS beta version on Apple Silicon. It requires local access and does not use any network endpoints. The repository also contains a 'slides' directory with a Reveal.js-based presentation explaining the vulnerability and exploit, but the actual exploit code is in the 'demo_exploit' directory. The exploit is operational and provides a working local privilege escalation chain for research and demonstration purposes.