Dive into Apple UserFS (Userspace Filesystem)

Apple UserFS: A comprehensive dive into the new file system technology, including vulnerabilities and attack surfaces, and the possibilities of remote exploitation.

Key takeaways

Apple UserFS is a new file system technology that runs file system code in userspace, allowing iOS to support various file systems beyond APFS and HFS.
In UserFS, the file system kernel extension (LIFS) forwards kernel calls to user space demons, which in turn call file system plugins such as ExFAT.
UserFS is designed to work with external storage devices, such as USB drives, but Apple’s sandboxing mechanism is always on, making it hard to access LiveFS kernel extensions directly.
There are vulnerabilities found in UserFS, including a NULL pointer dereference bug and lack of checks on entries offset in AttrHeader and loadF methods.
It is possible to exploit these vulnerabilities remotely, but it requires a lot of extra work and knowledge of the file system to create a reliable exploit.
New features and plugins in UserFS lead to increased attack surfaces, making UserFS more vulnerable to attacks.

Dive into Apple UserFS (Userspace Filesystem)

More talks