Wednesday, May 22, 2024

Google Project Zero Released Apple macOS Unpatched Zero-day Exploit PoC Online – Apple Crossed 90-day Deadline

Security Expert from Google Zero Project released a PoC Exploit for Apple macOS kernal zero-day vulnerability that is failed to patch by Apple within 90 days, a deadline of bug disclosure policy followed by Google.

Google built a full-time dedicated Security team, known as Project Zero, that aims to prevent targeted attacks by reporting bugs to software vendors and filing them in an external database.

A bug discovered in macOS XNU kernel that allows attacker to manipulate and change the nature of the file system image on-disk file without informing the virtual management subsystem.

“XNU has various interfaces that permit creating copy-on-write(COW) copies of data between processes, including out-of-line message descriptors in mach messages.”

Copy-on-write ( referred to as “COW”) is an optimization strategy or resource management technique used in computer programming

So the copied memories should be protected from later modifications by the source process, if not then the source process might be able to exploit double-reads in the destination process.

According to Google Project Zero, “This copy-on-write behavior works not only with anonymous memory but also with file mappings. This means that, after the destination process has started reading from the transferred memory area, memory pressure can cause the pages holding the transferred memory to be evicted from the page cache. Later, when the evicted pages are needed again, they can be reloaded from the backing filesystem.”

In this case, Google published the Proof-of-concept that demonstrates this Zero-day flaw and also you can download the exploit here.

“This bug is subject to a 90-day disclosure deadline. After 90 days elapse or a patch has been made broadly available (whichever is earlier), the bug report will become visible to the public.”

Google always following Aggressive disclosure policies makes software vendors to strictly focus on their security bugs and keep them working and fix it as soon as possible.

Google Project zero team contact with Apple regarding this issue, and at this point no fix is available at this time and Apple will be fixed this issue and release the update in future security updates. Google said.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Also Read:

ZDI Exposed Unpatched Microsoft RCE Zero-day Flaw in Public After it Crossed the 120 Days Deadline

Hackers Exploit Cisco Zero Day Vulnerability in Wild Resulting in DoS Condition

Hackers Started Exploiting the Unpatched Windows Task Scheduler Zero Day Flaw using Malware

Apple Released Security Update & Fixes for iOS FaceTime Zero-day Vulnerability

Website

Latest articles

OmniVision Technologies Cyber Attack, Hackers Stolen Personal Data in Ransomware Attack

OmniVision Technologies, Inc. (OVT) recently disclosed a significant security breach that compromised its clients'...

Critical Flaw In Confluence Server Let Attackers Execute Arbitrary Code

The widely used team workspace corporate wiki Confluence has been discovered to have a...

Threat Actors Leverage Bitbucket Artifacts to Breach AWS Accounts

In a recent investigation into Amazon Web Services (AWS) security breaches, Mandiant uncovered a...

Hackers Breached Western Sydney University Microsoft 365 & Sharepoint Environments

Western Sydney University has informed approximately 7,500 individuals today of an unauthorized access incident...

Memcyco Report Reveals Only 6% Of Brands Can Protect Their Customers From Digital Impersonation Fraud

Memcyco Inc., provider of digital trust technology designed to protect companies and their customers...

DoppelGänger Attack: Malware Routed Via News Websites And Social Media

A Russian influence campaign, DoppelGänger, leverages fake news websites (typosquatted and independent) to spread...

Critical Memory Corruption In Cloud Logging Infrastructure Enables Code Execution Attack

A new critical vulnerability has been discovered in Fluent Bit's built-in HTTP server, which...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles