DarkSword Kernel Escalation CVE-2025-43510 and CVE-2025-4352...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://8ksec.io/darksword-kernel-escalation-cve-2025-43510-43520
• Blog Title: DarkSword Kernel Escalation: CVE-2025-43510 and CVE-2025-43520
• Suggested Section: Binary Exploitation > iOS Exploiting > XNU vm_map COW aliasing and vnode TOCTOU exploitation

🎯 Content Summary

Scope, evidence, and limitations

The post analyzes stages 4 and 5 of the DarkSword iOS exploit chain reported by Google TAG/GTIG in March 2026. The chain starts with stable arbitrary read/write inside com.apple.WebKit.GPU, obtained through earlier JavaScriptCore and WebGL/ANGLE stages, but with no kernel primitive and continued GPU sandbox restrictions. It then chains CVE-2025-43510, a copy-on-write handling issue in XNU's vm_map subsystem, w...

🔧 Technical Details

OOL COW mismap for cross-process corruption: audit Mach/XPC OOL transfer paths for cases where vm_map_copy_overwrite* creates a writable destination entry but fails to detach it from the source vm_object. Carefully selected size and offset geometry, non-fast-path processing, buffer reuse, or lock transitions may leave an RW destination alias that does not trigger a COW fault. Retaining that mapping after normal IPC object release converts memory access in one sandboxed process into reads and writes against another process.

Entitlement pivot through a reachable daemon: enumerate the global Mach services authorized by a compromised process's mach-lookup.global-name entitlement and identify daemons that accept complex OOL objects while possessing broader Mach or IOKit entitlements. A cross-process memory primitive can overwrite a deferred callback and reuse existing PAC-signed targets plus JOP gadgets, avoid...

🤖 Agent Actions

Implemented the HackTricks update:

• Added src/binary-exploitation/ios-exploiting/xnu-vm-map-cow-vnode-toctou.md.
• Documented COW aliasing, entitlement pivots, vnode TOCTOU/UAF modeling, same-type grooming, primitive escalation, data-only post-exploitation, ipsw triage, and detection.
• Clearly separated confirmed DarkSword behavior from speculative exploitation modeling.
• Corrected patch versions to the primary-source values: iOS/iPadOS 18.7.2 and 26.1.
• Linked the page from the iOS exploitation README and src/SUMMARY.md.
• Verified citations, references, internal links, formatting, and forbidden-source exclusion.

mdbook build could not run because mdbook is not installed; all available static checks passed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://8ksec.io/darksword-kernel-escalation-cve-2025-43510-43520

Content Categories: Based on the analysis, this content was categorized under "Binary Exploitation > iOS Exploiting > XNU vm_map COW aliasing and vnode TOCTOU exploitation".

Repository Maintenance:

• MD Files Formatting: 1030 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0