Kernel input sanitization flaw in Apple operating systems

This repository is a standalone local privilege escalation exploit for Apple macOS on arm64/arm64e, branded 'DirtySlide'. It targets a kernel bug in the v5 dyld shared-cache slide walker reachable through syscall 536, described as an 8-byte out-of-bounds kernel read/write adjacent to a shared-cache page. The README states the issue is patched in macOS 26.5.2 and vulnerable through the 26.5 betas, with testing performed on macOS 26.5 in an Apple Virtualization VM. Repository structure: the Makefile orchestrates the full build and packaging flow into a portable dist/ payload directory. It compiles three main binaries: (1) reslide_child from src/t_reslide_zf.c, the core exploit child that performs the shared-region slide manipulation and kernel-memory/PTE/credential scanning logic; (2) reslide_launcher from src/launcher.c, a wrapper that opens the target dyld shared cache, sets _POSIX_SPAWN_RESLIDE, applies DYLD-related environment variables, and spawns the child; and (3) suidwrap from src/suidwrap.c, a post-exploitation setuid-root handoff helper. The build also creates a fakelib directory containing crafted libdyld.dylib and libSystem.B.dylib shims from src/fake_libdyld.cpp and src/fake_libsystem.c. The Python scripts are binary-patching/build helpers rather than exploit logic themselves: patch-static-child-dyld.py modifies the static child Mach-O to add LC_LOAD_DYLINKER and LC_MAIN pointing at /usr/lib/dyld; add-load-dylib.py injects an LC_LOAD_DYLIB command for /usr/lib/system/libdyld.dylib; set-segment-flag.py toggles Mach-O segment flags; run-on-guest.sh is the operational runner used on the target host. Exploit flow: run-on-guest.sh stages /tmp/lpe_suidwrap, points CHILD_DYLD_LIBRARY_PATH at the local fakelib directory, sets CHILD_DYLD_SHARED_CACHE_DIR to /tmp/does-not-exist, and launches reslide_launcher with the real dyld shared cache path. The launcher opens the cache and dup2s it to fd 3 for the child, then spawns the child with _POSIX_SPAWN_RESLIDE. The child source (t_reslide_zf.c) is a large, heavily parameterized exploit implementing the vulnerable syscall invocation, target mapping/oracle setup, page-table entry aliasing/physical scanning, and credential patching logic. The Makefile compile-time defines show the intended operational mode: physical credential scan and patching are enabled, root proof is enabled, and a setuid handoff path is used. Post-exploitation behavior: after the child obtains uid 0 by patching credentials, it is intended to chown/chmod the staged wrapper at /tmp/lpe_suidwrap to setuid-root. The runner then executes that wrapper as a fresh process. suidwrap calls setgid(0)/setuid(0), writes a proof file to /var/root/claude_shell_proof, remains alive briefly using non-forking syscalls to avoid instability, and optionally execs /bin/sh -i when POP_INTERACTIVE is set. This makes the exploit operational rather than a mere PoC: it includes a concrete privilege-escalation payload and a reusable root shell handoff. No network communication or remote C2 is present. The attack vector is purely local. Notable operational caveat: the exploit is unstable by design, with comments and scripts warning that the physical scan can panic the kernel roughly 50% of the time, requiring reruns or rebooting the VM.

This repository is a real local macOS kernel exploit research project targeting Apple XNU dyld shared-region slide-info v3/v5 handling, centered on syscall #536 (shared_region_map_and_slide_2_np). The code is not a framework module and contains multiple standalone C components plus a small build harness. The main exploit logic is in rie.c, which orchestrates spawning a suspended RESLIDE child, hijacking its thread state, and invoking a pre-dyld payload in the child to become the shared-region first mapper and submit crafted slide metadata. The crafted blob is built by slide_blob.c/slide_blob.h and deliberately passes kernel sanity checks while poisoning page_starts[target_page] with 0xFFFE so vm_shared_region_slide_page_v5/v3 walks off-page and performs kernel OOB read/write. Repository structure: inject/build.sh builds two helper binaries; inject/host.c is a host-safe validation harness that spawns inject/child.c suspended, obtains task_for_pid, finds the child Mach-O base, redirects PC to child_probe(), resumes execution, and interprets exit codes from shared_region_check_np (#294) to determine whether the target has a bound-but-empty shared region suitable for first-mapper exploitation. inject/child.c contains two pre-dyld raw-syscall payloads: child_probe() for viability testing and child_trigger() for the real exploit path. child_trigger() opens two cache-related files whose paths are supplied in struct sr_cfg, patches file descriptors into shared_file structures, invokes syscall #536, calls shared_region_check_np to nest the submap, and faults carrier pages to trigger the vulnerable slide walker. sr_cfg.h defines the shared configuration layout injected into the child. The later-stage exploitation code is operational but highly environment-specific. kpwn_iomdtest.c implements a real IOSurface/IOBufferMemoryDescriptor grooming and over-map harness to turn the slide OOB into a relative kernel read primitive by corrupting IOBMD length fields. kpwn_primitive.c bridges the OOB into kernel R/W primitives using corrupted pipe control fields while avoiding PAC-protected pointers. kpwn_continuation.c then uses arbitrary kernel read/write to lift and transplant a signed thread continuation pointer, aiming for kernel PC control with x0 under attacker control. vmapple_offsets.h contains build-specific offsets and gadget addresses for a vmapple kernel; comments also reference other Apple Silicon targets/builds. Capabilities: host-safe first-mapper detection, real kernel OOB trigger, kernel panic/reboot trigger, grooming for relative kernel memory access, KASLR leak path, arbitrary kernel R/W development path, and kernel continuation pivot for code execution. There are no network C2 or remote endpoints; the attack surface is purely local and file-backed, relying on Mach task APIs, Apple-specific entitlements, crafted shared-region mapping metadata, and local child process manipulation.