# CVE-2020-27932: iOS Kernel privesc with turnstiles

iOS kernel type confusion between ipc_port and host_notify_entry via IKOT_HOST_NOTIFY turnstile semantics enables out-of-bounds write, used in a real exploit chain for kernel privesc.

- Payout: Real-world hack
- Severity: high
- Program: Apple iOS
- Credited: Ian Beer, Project Zero (Originally posted on [Project Zero blog](https://googleprojectzero.blogspot.com/p/rca.html) 2021-02-04)
- Disclosed: 2020-11-05
- CVE: CVE-2020-27932
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2020/CVE-2020-27932.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2020-27932
- Tags: domain:mobile domain:oss impact:privesc kind:incident platform:project-zero sev:high tech:ios technique:chained technique:source-review vuln:memory-corruption vuln:privilege-escalation

**Target:** iOS XNU kernel Mach port turnstile / special reply port handling
**Root cause:** Turnstile code fails to account for userspace-owned ports becoming IKOT_HOST_NOTIFY, so ipc_port_adjust_special_reply_port_locked reads a host_notify_entry pointer from the kdata union's sync_inheritor_port field as an ipc_port, causing type confusion and OOB write.
**Steps:**
1. Send a mach message to a destination port with thread_special_reply_port as msgh_local_port and SEND_ONCE disposition.
2. Set MACH_SEND_SYNC_OVERRIDE flag on that send to move ip_sync_link_state away from PORT_SYNC_LINK_ANY.
3. Convert the thread's special_reply_port to IKOT_HOST_NOTIFY via host_request_notification, setting kobject to a host_notify_entry.
4. Receive a message on that special_reply_port to trigger ipc_port_adjust_special_reply_port_locked reading sync_inheritor_port as an ipc_port, yielding type confusion and OOB write.
**How found:** Variant analysis of prior type confusions in the ipc_port kdata union (e.g. imp_task/kobject via IKOT_HOST_NOTIFY fixed in MacOS 10.10); manual review of turnstile code added around iOS 12 that introduced sync_inheritor_port.
**Exploitation:** Used as the kernel privesc stage of an iOS exploit chain, after a Safari RCE (CVE-2020-27930) and kernel memory disclosure (CVE-2020-27950); exploit flow still under analysis.
**Escalation:** Chained after Safari RCE and kernel memory disclosure to escalate from userspace to kernel privileges.
**Insight:** Audit complex unions in kernel objects where userspace can mutate the active member (IKOT_HOST_NOTIFY flipping kobject); check every reader of union fields for whether the port type can change underneath it.