XNU kernel panic triggered by mach_vm_read_overwrite from user-space

Originator:oleavr
Number:rdar://19895485 Date Originated:20-Feb-2015 00:13 AM
Status:Open Resolved:
Product:OS X Product Version:10.10.2 (probably many other versions too)
Classification: Reproducible:Always
 
Summary:
When asking mach_vm_read_overwrite to read a range spanning COW -> PRV -> COW pages, a kernel panic is triggered. Please see the attached test-case, which crashes the XNU kernel on both Mac OS X Yosemite and iOS 8.1. This was discovered after www.frida.re triggered it by accident.

Steps to Reproduce:
1. Run the xnu-panic universal binary on Mac or iOS, or compile xnu-panic.c yourself and run it.

Expected Results:
No kernel panic.

Actual Results:
Kernel panic.

Version:
10.10.2 (probably many other versions too)

Notes:
None.

Configuration:
Any hardware.

Attachments:
'xnu-panic.c' and 'xnu-panic' were successfully uploaded.

(Attachments not available here. See https://medium.com/@oleavr/diy-kernel-panic-os-x-and-ios-in-10-loc-c250d9649159 for details.)

Comments


Please note: Reports posted here will not necessarily be seen by Apple. All problems should be submitted at bugreport.apple.com before they are posted here. Please only post information for Radars that you have filed yourself, and please do not include Apple confidential information in your posts. Thank you!