# CVE-2020-27950: XNU Kernel Memory Disclosure in Mach Message Trailers

Incorrect size calculation in XNU Mach message trailer handling leaks 4 bytes of stale kalloc memory, disclosing kernel pointers used in an iOS exploit chain.

- Payout: Real-world hack
- Severity: medium
- Program: Apple iOS
- Credited: Ian Beer, Project Zero (Originally posted on [Project Zero blog](https://googleprojectzero.blogspot.com/p/rca.html) 2021-02-04)
- Disclosed: 2020-11-05
- CVE: CVE-2020-27950
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2020/CVE-2020-27950.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2020-27950
- Tags: domain:mobile impact:data-leak impact:privesc kind:incident platform:project-zero sev:medium tech:ios technique:chained technique:fuzzing technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** XNU kernel Mach message trailer receive path
**Root cause:** Incorrect size calculation when receiving mach messages requesting an invalid combination of trailer elements causes four bytes of an allocation to be read without being written, disclosing stale kalloc data.
**Steps:**
1. Groom target kalloc size class with out-of-line port descriptors containing pointers to ports
2. Free those allocations and reallocate them as mach messages
3. Trigger the trailer size miscalculation when receiving the messages to read 4 bytes of the target pointer
4. Adjust message size to leak the remaining 4 bytes of the pointer
**How found:** Text notes it likely could have been found by fuzzing configured to detect uninitialized memory reads (allocation not freed, just four bytes never written before read), or via manual analysis.
**Exploitation:** Attacker grooms a kalloc size class so a port pointer sits at the right offset, frees and reallocates as mach messages, then triggers the trailer bug on receive to read 4 bytes of the pointer; message size is adjusted to leak the other 4 bytes. Used in an iOS chain after Safari RCE (CVE-2020-27930) and before kernel privesc (CVE-2020-27932).
**Escalation:** Chained between a Safari RCE and a kernel privilege escalation to defeat kernel ASLR/leak pointers needed for the privesc stage.
**Insight:** Hunt for structures copied to userspace that aren't zero-initialized: an invalid/edge-case combination of requested trailer elements can leave a few bytes unwritten, and grooming the same kalloc size class with pointer-bearing objects (out-of-line port descriptors) turns that into a controlled pointer leak.