Skip to content

Nyxian 0.11.0 "Scriptura" Beta

Choose a tag to compare

@mach-port-t mach-port-t released this 09 Aug 12:13
· 122 commits to main since this release

Changelog

Nyxian

LiveProcess

  • Vulnerability Patch: UB in snapshotting mechanism. (7f9a6f6)
  • Fix: zero *tp_out out before task_for_pid. (f3af94c)
  • Fix: return NULL if no main entry in MachO could have been found. (86e2d49)
  • Swaps now the CFBundle and releases the main one entirely. (b3270a1)
  • Now the main bundle is recognized as loaded and as executable. (3e4ec59, 9075d96, f34b78e)
  • Now it hooks dlsym instead of dlopen when redirecting UIApplicationMain. (a464c42)
  • Now it will show error on failure loading guest executable. (a8f05fe)

Micro Kernel (ksurface)

  • Vulnerability patch: privilege escalation in permission check. (f42ba51)
  • Vulnerability patch: DOS in permission check. (c631b9d)
  • Vulnerability patch: OOM null ptr deref in radix tree. (a72cf36)
  • Vulnerability patch: OOM null ptr deref in radix tree. (5b81cdc) (separate vulnerability yes)
  • Vulnerability entry patch: race condition entry due to unchecked initialization of a mutex. (b3a406e)
  • Vulnerability patch: Dangling process object crafting via failure path in SYS_handoffep. (83a6408) (found by @semvis123)
  • Vulnerability patch: TOCTOU in installd daemon. (32847a5)
  • Vulnerability patch: null ptr deref in installd daemon's doWeTrustThatBundle: method. (43b4bec)
  • Vulnerability patch: LCMapMachO null ptr derefs. (f4e33cb)
  • Vulnerability patch: OOB in entitlement_mach_verify. (369a6c2, 9d40768)
  • Vulnerability patch: TOCTOU in LCBootstrap.m. (acdc3f6, 399e5a3, 03095d4, 20e871f, 98f9183, 7474bb1)
  • Fix: Reconnection issues with daemons. (df0376d, c1d3949)
  • On terminate of PEProcess uses now SIGTERM gives the process time to quit and after an amount of time if exceeded turns into a SIGKILL. (5e3307c)
  • Uses now a guarded mach port as the syscall server receive port. (898edc4)

Contributors: @semvis123, @mimalloc