CVE-2024-27815

XNU kernel heap buffer overflow in sbconcat_mbufs() (bsd/kern/uipc_socket2.c), reachable by an unprivileged local user over the AF_UNIX datagram socket layer.

A socket address of up to SOCK_MAXADDRLEN (255) bytes is copied into an mbuf data area only MLEN (224) bytes long, overwriting up to 31 bytes of the header (m_hdr) of the adjacent mbuf. Every field of that header except the high byte of mh_flags becomes attacker-controlled, resulting in a kernel panic.

Affected versions

• Introduced: xnu-10002.1.13 (macOS 14.0 / iOS 17.0)
• Fixed in: xnu-10063.121.3 — shipped publicly on May 13, 2024 in macOS 14.5, iOS 17.5, iPadOS 17.5, watchOS 10.5, tvOS 17.5, and visionOS 1.2
• Requires: a kernel built with CONFIG_MBUF_MCACHE (all shipping builds)
• Impact: unprivileged local denial of service (kernel panic)

Contents

cve-2024-27815.c    PoC trigger
README.md           this file

Build & run

cc -O2 -Wall -Wextra cve-2024-27815.c -o cve-2024-27815
./cve-2024-27815

On a vulnerable kernel the payload panics the machine; on a patched kernel the process exits cleanly.

References

• Writeup: https://jprx.io/cve-2024-27815

Hash

SHA-256 of cve-2024-27815.c (current revision, tracked in git):

$ sha256sum cve-2024-27815.c
90eab38b30683aa9c9f364b0f0e914e5b1e5f477086073e361352244a3ac55ac  cve-2024-27815.c