CVE-2018-4090

An attacker with the ability to run a crafted app on the system calls `sysctl()` with the name `{ CTL_VFS, VFS_GENERIC, VFS_CONF, 0x17 }` to read a `struct vfsconf` [ref_id=1]. The kernel copies the entire structure — including the uninitialized padding byte between `vfc_name` and `vfc_typenum` — to user space via `SYSCTL_OUT` [ref_id=1]. Because the padding byte is never zeroed, it leaks whatever kernel stack data happens to occupy that location, allowing the attacker to bypass intended memory-read restrictions [ref_id=1].

The vulnerability is in the `sysctl_vfs_generic_conf()` function within the macOS kernel, which handles the `vfs.generic.conf.*` sysctls. The function copies a `struct vfsconf` to user space via `SYSCTL_OUT(req, &vfsc, sizeof(struct vfsconf))` [ref_id=1]. The `struct vfsconf` contains a `char vfc_name[MFSNAMELEN]` field (15 bytes) followed by `int vfc_typenum`, creating one uninitialized padding byte between them that is never zeroed before being copied out [ref_id=1].

The advisory does not include a patch, but the root cause is clear: the `struct vfsconf` has a one-byte padding gap between `vfc_name` (15 bytes) and `vfc_typenum` (4-byte int) that is never initialized before being copied to user space [ref_id=1]. A proper fix would zero-initialize the entire `struct vfsconf` (e.g., using `memset(&vfsc, 0, sizeof(vfsc))`) before populating its fields, or explicitly zero the padding byte. Apple addressed this in iOS 11.2.5, macOS 10.13.3, tvOS 11.2.5, and watchOS 4.2.2.

Compile and run the following program on an affected macOS system (e.g., 10.13.0):

```c #include