From 6bb476a534e0210633fd7713222f752f777b1bb3 Mon Sep 17 00:00:00 2001 From: JBJF Date: Sat, 31 Oct 2026 17:35:09 +0800 Subject: [PATCH] kernel diff: candidate fix-site functions for sdl/mbuf/vm_map/framebank checks --- docs/IOS27.2-KERNEL-DIFF.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/docs/IOS27.2-KERNEL-DIFF.md b/docs/IOS27.2-KERNEL-DIFF.md index 20cb021..9422d22 100644 --- a/docs/IOS27.2-KERNEL-DIFF.md +++ b/docs/IOS27.2-KERNEL-DIFF.md @@ -146,6 +146,24 @@ GAPF race, hibernation handoff, SK tag-page aliasing, dangling tag storage) are 27.2 changes add checks, and the candidate paths need a reachable primitive that the diff does not contain. +## Kernel fix-site candidates (27.2, address in the final 24B119 kernelcache) + +These are the functions that reference the new 27.2 strings. They are candidate +fix sites for the 15 Kernel CVEs; the advisory does not map a CVE to a function, +so treat the CVE attribution as an inference. + +| New string | Function (27.2) | Likely area | +|---|---|---| +| `size <= sdl->sdl_alen` | `0xfffffe000af62474` (assert at `0xfffffe000af6274c`) | sockaddr_dl / ifaddr bounds (info leak candidate, cf. 112665) | +| `Failed mbuf validity check` | `0xfffffe000af238ac`, `0xfffffe000af42e70`, `0xfffffe000b08a1bc`, `0xfffffe000b1357a0` | mbuf length vs off+len (OOB read/write candidate) | +| `VM entry %p lock shared lock overflow` | `0xfffffe000b52ed74` | vm_map shared-lock state (COW / 112576 candidate) | +| `Page modified after framebank withdraw %p` | `0xfffffe000adf71b8` | pmap page lifecycle (UAF candidate) | + +The `sdl` site is the most user-reachable of the four: it is on the network +interface/address path and the string is an assertion added in 27.2. The mbuf +site is next. Neither has a trigger or a demonstrated R/W effect; they are the +next functions to audit with a device. + ## What can be turned into a PoC | CVE | Primitive | PoC status |