Google Project Zero Exposes Severe macOS XNU Kernel Flaw After Apple Inaction

Google Project Zero Exposes Severe macOS XNU Kernel Flaw After Apple Inaction

Google Project Zero Exposes Severe macOS XNU Kernel Flaw After Apple Inaction

A security researcher from Google's Project Zero has identified a "high severity" security flaw in macOS kernel XNU, that allows copy-on-write (COW) behaviour in some cases (via Neowin).

Through its Project Zero team, Google has appointed itself a vanguard of software security and accountability.

"This copy-on-write behavior works not only with anonymous memory, but also with file mappings", Google's security researchers explained.

Apple's desktop software has gotten significantly more reliable since the release of macOS Mojave last fall, but major flaws continue to slip through the cracks. From time to time, these warnings go unheard until the flaw is made public. In short, if user-owned mounted filesystem image is modified, the virtual management subsystem isn't kept in the loop. According to a report from Neowin, that particular team discovered a "high severity" flaw in the macOS kernel in November of previous year.

If an attacker, therefore, is able to tamper with an on-disk file without the virtual management subsystem being alerted, this is a severe security issue which needs to be tackled. MacOS permits normal users to mount filesystem images.

Two Welsh PRO14 Clubs Set To Merge In Absolutely Extraordinary Story
A radical merger between Ospreys and Scarlets is on the cards ahead of a meeting of Welsh rugby's top brass on Tuesday.

Google's Project Zero sticks to a stringent 90-day deadline for vulnerabilities. "When a mounted filesystem image is mutated directly (e.g.by calling pwrite () on the filesystem image), this information is not propagated into the mounted filesystem".

It's often claimed that Apple Inc. products are safe from hacking, but even though that has been proven to be false time and time again, a new vulnerability has emerged that suggests threats have graduated from a soldier with a gun to a B-52 dropping a large bomb.

Apple is working on a fix for the problem, but Mac users will remain vulnerable until a solution is implemented.

"We've been in contact with Apple regarding this issue, and at this point no fix is available", the researchers say.

"Apple are intending to resolve this issue in a future release, and we're working together to assess the options for a patch", a comment on the bug reads.

Recommended News

  • America and China 'close to agreeing deal that ends trade war'

    America and China 'close to agreeing deal that ends trade war'

    Among the biggest losses for American farmers: oilseeds and grains exports, which are top agricultural products that Iowa farmers send to China .

    Los Angeles Clippers vs. Los Angeles Lakers Prediction, Preview, and Odds

    The Los Angeles Clippers are averaging 113.9 points on 46.7 percent shooting and allowing 113.7 points on 45.5 percent shooting. The Los Angeles Clippers are shooting 37.9 percent from beyond the arc and 79.4 percent from the free throw line.
    Logano Scores First Win Of Season

    Logano Scores First Win Of Season

    Nine different drivers shared the lead with Harvick up front the longest (88). 1 time for 5 laps; Austin Dillon 1 time for 2 laps. After Harvick pitted, Logano inherited the lead until he did the same on lap 50, leading to Daniel Suárez enjoying time in first.
  • Hope as man 'free of HIV virus' after treatment

    Hope as man 'free of HIV virus' after treatment

    About 37 million people worldwide now have HIV, and the AIDS virus has killed about 35 million since taking off in the 1980s. The Berlin patient was actually an American (real name: Timothy Ray Brown ) diagnosed with HIV while living in Germany.
    Pyrex-owner Corelle cooks up merger with Instant Pot-maker

    Pyrex-owner Corelle cooks up merger with Instant Pot-maker

    Financial details were not released, but the two companies said in a joint statement that the deal is expected to close this year. Corelle, which is headquartered in Rosemont, Ill., manufactures and markets multiple houseware brands, including Pyrex.
    Jessica Simpson Hospitalized for Bronchitis Amid Pregnancy

    Jessica Simpson Hospitalized for Bronchitis Amid Pregnancy

    Jessica Simpson revealed she was hospitalized for bronchitis last week, making it her fourth trip to the hospital in two months. The pregnant singer posted a selfie on Instagram showing her wearing a surgical mask and an animal print hooded sweatshirt.
  • Five takeaways from Michigan's 69-62 win at Maryland

    Five takeaways from Michigan's 69-62 win at Maryland

    After a disappointing loss to in-state rival Michigan State last Sunday, Michigan had to stew in the defeat for three days. In the win over the Cornhuskers, Michigan's lead scorer was Jon Teske with 22 points and 10 rebounds.
    Federer hits 100 career wins with Dubai crown

    Federer hits 100 career wins with Dubai crown

    Federer lost to the 20-year-old Tsitsipas, a rising star from Greece, in the last 16 of the Australian Open in January. This is where I've won so many of them, been around for so long.
    Harry Kane: Tottenham need to 'step up under pressure'

    Harry Kane: Tottenham need to 'step up under pressure'

    He told us: "They are with the squad but we need to assess them this afternoon and tomorrow to see if they are in contention".
  • Montez Sweat: I just want to be as versatile as possible

    Montez Sweat: I just want to be as versatile as possible

    The player didn't specify which team had asked the question, although it was not the only freaky interview incident. Most of those prospects performed as expected, but several exceeded expectations while others disappointed.
    Treasury Board President Jane Philpott resigns from cabinet citing SNC-Lavalin affair

    Treasury Board President Jane Philpott resigns from cabinet citing SNC-Lavalin affair

    Resigning from cabinet on a matter of principle is so old-fashioned it evokes images of monocles, pocket watches and top hats. Mr Trudeau has denied political meddling to shield engineering firm SNC-Lavalin from a bribery trial.
    Apex Legends Racks Up 50 Million Players in Its First Month

    Apex Legends Racks Up 50 Million Players in Its First Month

    It's been one month to the day since Apex Legends had a surprise launch on PC, PS4, and Xbox One , and what a month it's been. If you're out of the loop on Apex Legends and wondering what all the fuss is about, no worries.

We are pleased to provide this opportunity to share information, experiences and observations about what's in the news.
Some of the comments may be reprinted elsewhere in the site or in the newspaper.
Thank you for taking the time to offer your thoughts.