oss-sec mailing list archives

Re: Privilege escalation with kill(-1, SIGKILL) in XNU kernel of macOS High Sierra

From: Graham Christensen <graham () grahamc com>
Date: Thu, 12 Oct 2017 08:12:59 -0400


One follow-up for the discussion on if this is a DoS or privilege
escalation, in the logs we saw:

    Service exited due to signal: Killed: 9 sent by nix-daemon[54108]

and were able to (inconsistently) reproduce this with other unprivileged
users.

This indicated to us that we hadn’t tripped just a crashing bug, but
actually escalated beyond the normal access control protections of kill.

Graham

Current thread:

Privilege escalation with kill(-1, SIGKILL) in XNU kernel of macOS High Sierra Shea Levy (Oct 11)
- Re: Privilege escalation with kill(-1, SIGKILL) in XNU kernel of macOS High Sierra Kurt Seifried (Oct 11)
  - Re: Privilege escalation with kill(-1, SIGKILL) in XNU kernel of macOS High Sierra Hunger (Oct 12)
    - Re: Privilege escalation with kill(-1, SIGKILL) in XNU kernel of macOS High Sierra Roman Medina-Heigl Hernandez (Oct 12)
- Re: Privilege escalation with kill(-1, SIGKILL) in XNU kernel of macOS High Sierra Graham Christensen (Oct 12)