Privilege escalation with kill(-1, SIGKILL) in XNU kernel of macOS High Sierra

>We have found an issue in the XNU kernel of macOS High Sierra wherein an unprivileged user can terminate all running processes using the kill system call. In short, a completely unprivileged user can bring down the entire system with kill(-1, SIGKILL) (and, in a shell, kill SIGKILL -1), so long as there is at least one other process running owned by that user. In some cases we've seen it take a few tries in a loop to actually trigger the issue.

>We have reported the issue to Apple, who do not see it as a security concern. On its own the ability to easily bring down a multi-user system is concerning, but the fact that we found this accidentally and that the behavior is exactly what you'd expect if there were no permissions check for the kill call at all leads us to believe that there is likely more that can be done to exploit this issue. Some reports include log messages showing services being killed prior to the system breaking, though this has been difficult to reproduce.

archive.fo/g8s04 ( groups.google.com/forum/#!topic/nix-devel/KV9eomIdxWE )

Other urls found in this thread:

acsac.org/2002/papers/classic-multics.pdf
twitter.com/AnonBabble

hi I'm a mac :^)

...

The mac userbase willingly give their data and agency to anyone who asks so what's the point of an explooit?

...

Eerie.

Now to figure a way to do this on multiple systems at once over a network, preferably with making it autostart.

He looks even gayer than the Dell Dude.

This is such an old ritual of etiquette, to greet and formally introduce yourself before talking. It goes back to interactions of the upper classes, letters, telephone and even in video when it's fucking obvious there is no need. From video chats to youtube, fuck me humans are weird.

So with "kill SIGKILL -1 1" i can kill the init?

Why didn't they stick to naming it after cats instead of gay shit like El Captain or Sierra?

Eventually they'd run out of actual cat species and have to name it after Big the Cat.

...

Jesus Christ what a fucking ripoff.

I swear it is like they just do not give a fuck about their desktop os anymore.


Just because. Starting with Mavericks, they decided to on a Mountain range naming scheme.

I'm pretty sure Dell dude came out before Mac guy.

your image says one thing but your post completely agrees with him

If UNIX really was a "simplified MULTICS" we wouldn't have these kinds of problems.
acsac.org/2002/papers/classic-multics.pdf

hey, it's me, autism

I think this particular problem happens because Apple is trying to (re)design a multi-user system for a single user.

Oh they care... they just only care about making it shinier, and easier for high functioning retards to use the OS. They probably assume most mactards have never seen a shell prompt in their life, no real worry of the average user diong shit like this.