Saturday, December 2, 2023

Google Project Zero Released Apple macOS Unpatched Zero-day Exploit PoC Online – Apple Crossed 90-day Deadline

Security Expert from Google Zero Project released a PoC Exploit for Apple macOS kernal zero-day vulnerability that is failed to patch by Apple within 90 days, a deadline of bug disclosure policy followed by Google.

Google built a full-time dedicated Security team, known as Project Zero, that aims to prevent targeted attacks by reporting bugs to software vendors and filing them in an external database.

A bug discovered in macOS XNU kernel that allows attacker to manipulate and change the nature of the file system image on-disk file without informing the virtual management subsystem.

“XNU has various interfaces that permit creating copy-on-write(COW) copies of data between processes, including out-of-line message descriptors in mach messages.”

Copy-on-write ( referred to as “COW”) is an optimization strategy or resource management technique used in computer programming

So the copied memories should be protected from later modifications by the source process, if not then the source process might be able to exploit double-reads in the destination process.

According to Google Project Zero, “This copy-on-write behavior works not only with anonymous memory but also with file mappings. This means that, after the destination process has started reading from the transferred memory area, memory pressure can cause the pages holding the transferred memory to be evicted from the page cache. Later, when the evicted pages are needed again, they can be reloaded from the backing filesystem.”

In this case, Google published the Proof-of-concept that demonstrates this Zero-day flaw and also you can download the exploit here.

“This bug is subject to a 90-day disclosure deadline. After 90 days elapse or a patch has been made broadly available (whichever is earlier), the bug report will become visible to the public.”

Google always following Aggressive disclosure policies makes software vendors to strictly focus on their security bugs and keep them working and fix it as soon as possible.

Google Project zero team contact with Apple regarding this issue, and at this point no fix is available at this time and Apple will be fixed this issue and release the update in future security updates. Google said.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Also Read:

ZDI Exposed Unpatched Microsoft RCE Zero-day Flaw in Public After it Crossed the 120 Days Deadline

Hackers Exploit Cisco Zero Day Vulnerability in Wild Resulting in DoS Condition

Hackers Started Exploiting the Unpatched Windows Task Scheduler Zero Day Flaw using Malware

Apple Released Security Update & Fixes for iOS FaceTime Zero-day Vulnerability

Website

Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Booking.com Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles