# Apple MIE exploitation challenge

Malicious SMB server triggers create-context type confusion in smbfs and malicious WebDAV server leaks uninitialized kernel memory, chained to kernel read/write and root.

- Payout: Research
- Severity: high
- Program: Apple
- Write-up by: Bruce Dang
- Disclosed: 2026-07-27
- CVE: CVE-2026-64704, CVE-2026-64699
- Write-up quality: 9/10
- Original: https://blog.calif.io/p/apple-mie-exploitation-challenge
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-apple-mie-exploitation-challenge
- Tags: area:os domain:desktop impact:data-leak impact:privesc kind:research platform:research sev:high technique:chained technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** XNU kernel smbfs and webdav_fs kexts via malicious SMB/WebDAV servers
**Root cause:** smb2_smb_parse_create_contexts casts create_contextp based on the server-echoed context name rather than the request type, reinterpreting a Resolve ID struct as a lease. webdav_read_bytes allocates an unzeroed buffer and uiomove's the requested length without verifying bytes actually received.
**Steps:**
1. Mount attacker SMB share advertising SMBV_OSX_SERVER, kAAPL_SUPPORT_RESOLVE_ID, SMBV_HAS_FILEIDS
2. Call `fsgetpath(2)` with attacker-chosen objid to trigger smb2fs_smb_cmpd_resolve_id with controlled file_id
3. Reply to the CREATE with an `RqLs` lease context instead of Resolve ID; parser casts resolve_id as smb2_dur_hndl_and_lease, treating file_id as leasep pointer
4. For WebDAV: mount attacker WebDAV share, read a region far ahead of cached prefix to hit webdav_read_bytes out-of-band path
5. Respond to the GET with empty `206 Partial Content` (2xx success, zero-length body)
6. webdav_sendmsg returns success without checking iolen; uiomove copies full requested count from uninitialized M_TEMP buffer to userspace
**How found:** Source review of open-source Apple SMBClient and webdavfs components; noticed parser switches on server-controlled context name rather than request state, and that webdav_sendmsg ignores iolen while webdav_read_bytes uses non-zeroed MALLOC and copies requested rather than received length.
**Exploitation:** Chain the SMB type confusion (attacker-influenced file_id used as leasep pointer, dereferenced/locked) with the WebDAV uninitialized kernel memory leak to defeat MIE mitigations, build kernel read/write primitives, and escalate from unprivileged user to root on macOS with full MIE enabled.
**Escalation:** Combine infoleak to defeat kernel ASLR/MIE pointer protections with type confusion for controlled pointer dereference, yielding kernel read/write then code execution and root.
**Insight:** In split kernel/userspace filesystem designs, audit where the kernel trusts the length/type it requested rather than what the untrusted userspace helper or remote server actually returned; server-echoed tags that select a cast are a classic type-confusion source.