A buffer overflow in the XNU kernel

#1

Post by jprx » Thu, Jun 20, 2024, 5:24 PM UTC

A buffer overflow in the XNU kernel
jprx.io

Re: A buffer overflow in the XNU kernel

#2

Post by bartvk » Thu, Jun 20, 2024, 7:44 PM UTC

If you're still running the affected kernel, what are the possible consequences?

Also, this has been public for months:

- February 17, 2024: I posted the hash of TURPENTINE.c to X on Feb 17, 2024.

- May 13, 2024: macOS Sonoma 14.5 (23F79) shipped with xnu-10063.121.3, the first public release containing a fix.

Re: A buffer overflow in the XNU kernel

#3

Post by throwaway71271 » Thu, Jun 20, 2024, 7:56 PM UTC

[flagged]

Re: A buffer overflow in the XNU kernel

#4

Post by saagarjha » Thu, Jun 20, 2024, 7:57 PM UTC

throwaway71271 wrote: post #3

[flagged]

It’s definitely nowhere near capable of doing that.

Re: A buffer overflow in the XNU kernel

#5

Post by [deleted] » Thu, Jun 20, 2024, 8:06 PM UTC

bartvk wrote: post #2

If you're still running the affected kernel, what are the possible consequences? Also, this has been public for months: - February 17, 2024: I posted the hash of TURPENTINE.c to X on Feb 17, 2024. - May 13, 2024: macOS Sonoma 14.5 (23F79) shipped with xnu-10063.121.3, the first public release containing a fix.

[deleted]

Re: A buffer overflow in the XNU kernel

#6

Post by favorited » Thu, Jun 20, 2024, 8:06 PM UTC

saagarjha wrote: post #4

throwaway71271 wrote: post #3

[flagged]

It’s definitely nowhere near capable of doing that.

Is "with a sufficiently smart LLM" the new "with a sufficiently smart compiler?"

Re: A buffer overflow in the XNU kernel

#7

Post by lpapez » Thu, Jun 20, 2024, 8:08 PM UTC

throwaway71271 wrote: post #3

[flagged]

Writing an exploit is usually much more difficult than patching the underlying bug.

Half of the work in fixing a bug report is getting a reproducible example. Nay, more than half.

If there was a magic AI which could generate exploits, I'd imagine there would be an equally magic AI patching the holes right out.

Re: A buffer overflow in the XNU kernel

#8

Post by brcmthrowaway » Thu, Jun 20, 2024, 8:15 PM UTC

saagarjha wrote: post #4

throwaway71271 wrote: post #3

[flagged]

It’s definitely nowhere near capable of doing that.

Have you used GPT-5?

Re: A buffer overflow in the XNU kernel

#9

Post by chad1n » Thu, Jun 20, 2024, 8:16 PM UTC

throwaway71271 wrote: post #3

[flagged]

There is a bigger chance that a toddler smashing a keyboard finds a bug than gpt5. LLMs can't understand intent, so they literally work like `grep` with little to no understanding of the context, so most of the time it will false flag good code.

There are already a lot of tools already to find bugs, like fuzzers, but I am sure that LLMs won't be one of them.

Re: A buffer overflow in the XNU kernel

#10

Post by vlovich123 » Thu, Jun 20, 2024, 8:16 PM UTC

lpapez wrote: post #7

throwaway71271 wrote: post #3

[flagged]

Writing an exploit is usually much more difficult than patching the underlying bug. Half of the work in fixing a bug report is getting a reproducible example. Nay, more than half. If there was a magic AI which could generate exploits, I'd imagine there would be an equally magic AI patching the holes right out.

Maybe but keep in mind that there’s often a substantial lag in practice between a fixed vulnerability and its deployment into production.

That said, I’m quite skeptical there’s any AI’s on the horizon that can autogenerate exploits from CVEs.