macOS Kernel wait_for_namespace_event() Race Conditio / Use-After-Free

In the macOS kernel, the XNU function wait_for_namespace_event() in bsd/vfs/vfs_syscalls.c releases a file descriptor for use by userspace but may then subsequently destroy that file descriptor using fp_free(), which unconditionally frees the fileproc and fileglob. This opens up a race window during which the process could manipulate those objects while they're being freed. Exploitation requires root privileges.


MD5 | cba1e82afa4ec28fd0073d6cfded8a11


Related Posts