2026-03-19 01:56 UTC
Replies (3)
-
@zhuowei@notnow.dev 2026-03-19 02:42
According to TAG’s analysis, DarkSword “uses CVE-2025-43520, a kernel-mode race condition in XNU’s virtual filesystem (VFS) implementation” I’m guessing it’s https://github.com/apple-oss-distributions/xnu/blob/bbb1b6f9e71b8cdde6e5cd6f4841f207dee3d828/bsd/vfs/vfs_cluster.c#L3700 ? There’s several VFS changes; not sure if this is the right one. If it is this one, I guess you’d somehow Make a contiguous memory region,start reading a file into it,then switch it to a non-contiguous region after it’s validated the region, but before it actually starts reading the file,so it ends up writing what it thinks is your contiguous area, but actually is the first part of your area followed by some other memory?
-
@artemist@social.mildlyfunctional.gay 2026-03-19 01:59
@zhuowei@notnow.dev i think that's called frida
-
@opa334@infosec.exchange 2026-03-19 02:14
@zhuowei@notnow.dev I assume this would be extremely complicated since you can't replace executable code and even doing something like interposes I would assume is very limited since I don't think it's easy to make native code call into javascript by replacing a pointer. I assume all they really do is call from JS into native code and of course there might be some stuff you can do with it, but I don't think it's much outside of well… what a malware would want to do 😛