A Pwn2Own Exploit Chain

Goal: achieve shellcode execution inside the sandboxed WebContent process

Bug exploited: incorrect optimization in the DFG JIT compiler

See also this BlackHat talk

The DFG JIT compiler represents JavaScript code in its own intermediate representation (IR), the Data Flow Graph (DFG). Goal: gain root via a LPE exploit

Bug exploited: XNU bootstrap port MitM

See also this POC talk

In XNU, the API allows callers to overwrite their bootstrap port, which is used to communicate with launchd. By overwriting the bootstrap port and forking a child processes, we can now gain a MitM position between our child and launchd (which our child expects to reach when sending messages to the bootstrap port).

Source: github.com