Kernel RCE in iOS/macOS with ICMP (lgtm.com)

My thought specifically was that "core networking code" is code that handles untrusted, unsolicited data potentially from the entire world, written in C, with special performance requirements that gives programmers a license to eliminate redundant bounds checks wherever possible..

Reproduced the bug in Golang. Pretty simple stuff. https://github.com/unixpickle/cve-2018-4407

Except this isn’t triggered with an ICMP packet. All it takes to trigger the crash is a specially formatted TCP packet.

Except it’s not a received ICMP packet that triggers the issue, it’s a TCP packet with large IP and TCP options. The crash occurs because the XNU kernel is sending an ICMP error in response to that received TCP packet.