task_t considered harmful

A Google Project Zero rundown of sandbox escape and privilege escalation bugs in Mac OS X and iOS fixed by Apple in OS X 10.9.5 and iOS 8.

This blog post revisits an old bug found by Pangu Team and combines it with a new, albeit very similar issue I recently found to try to build a "perfect" exploit for iOS 7.1.2.

A race condition in OS X and iOS setuid binary loading leaves a short window to manipulate the memory of an euid 0 process, potentially gaining entitlements and loading unsigned kernel extensions.

A Project Zero write-up on discovering and exploiting CVE-2017-2370, a heap buffer overflow in an iOS mach trap, using deliberate crashes to build a working exploit.

Second part of Project Zero's Pixel 9 zero-click chain research: auditing the BigWave AV1 decoder driver reachable from the mediacodec sandbox and finding bugs that yield kernel read and write.

Part one of a macOS audio series: building a fuzzer for CoreAudio by sending Mach messages, covering the attack surface, harness design, and early results.