At the Black Hat USA 2020 I presented a topic [1] related to the Apple IO80211Family, which discussed the architecture, attack surfaces, and numerous cases of kernel vulnerabilities for the Apple 80211 Wi-Fi kernel extensions. One and a half years have passed, and maybe you will be concerned about what new changes have taken place in the above fields? I would say, first of all, that new kernel vulnerabilities and attack surfaces are constantly being introduced while old bugs are being fixed. It's an endless game. Second, the IO80211Skywalk subsystems are becoming more and more important, and some of them have even been open sourced since XNU-8019.80.24. As security researchers, we need to regularly update our background knowledge and fuzzing framework. Next, the IO80211Family subsystem has been refactored again, and the version number in the IO80211FamilyV2 name has been removed. Of course, the changes behind this are not as simple as they seem.
As the research progressed, I quickly realized a new problem: the attack surfaces of the 80211 Wi-Fi subsystem are scattered all over the operating system, from user-mode daemons to the network protocol stack, and to IO80211Family.kext, IONetworkingFamily.kext, AppleBCMWLANCoreMac.kext, IOSkywalkFamily.kext and other kernel extensions. So, it became very important to integrate the fuzzing framework and make all the components work together, which motivated me to design a new 80211 Wi-Fi fuzzing system. As part of the output of this system, I will share with you more than a dozen zero-day kernel vulnerabilities. Through these brand new cases, this presentation will help you better understand the design of the Apple 80211 Wi-Fi subsystem and the security challenges it faces.
[1] https://www.blackhat.com/us-20/briefings/schedule/#dive-into-apple-iofamilyv-20023