Dive into Apple UserFS (Userspace Filesystem)

...In this talk, I will provide a brief overview of the Apple UserFS architecture and its functioning. Then, I will compare the changes in filesystem security after the introduction of UserFS. We will see that although UserFS reduces the kernel attack surface, it introduces some new attack surfaces. Following that, I will detail some vulnerabilities I found while reverse-engineering and analyzing UserFS, including both kernel and userspace vulnerabilities. The findings show that although UserFS hardens the filesystem, there is still …

apple architecture attack attack surface attack surfaces dive filesystem introduction kernel security