10.11 Fixes 0-day?

Discussion in 'OS X El Capitan (10.11)' started by newmac2013, Jun 13, 2015.

  1. newmac2013 macrumors newbie

    newmac2013

    Joined:
    Jun 4, 2013
    #1
    In reference to this thread "vulnerability of non-brand-new Macs (wake from sleep exploit)"

    http://forums.macrumors.com/threads...and-new-macs-wake-from-sleep-exploit.1888852/

    It looks like there is a 'bug' that allows EFI firmware to be overwritten when waking from sleep on macs older than 2014. From a comment on Ars:

    Drivers (if you mean kernel extensions) are executed in kernel space, not user space. And this exploit requires a Kernel Extension, DirectHW.kext, to be installed.
    Just wanting to confirm, that with rootless in 10.11 that this hole will be fixed.
     
  2. Rekan_ macrumors member

    Rekan_

    Joined:
    Jun 11, 2015
    Location:
    London, UK
    #2
    “It means that you can overwrite the contents of your BIOS from userland a rootkit EFI without any other tricks other than a suspend-resume cycle, a kernel extension, flashrom, and root access.

    This is something I found on a website talking of this exploit. It clearly mentions having root access, maybe if rootless is enabled, this could work. I'm not to sure though.
     
  3. SlCKB0Y macrumors 68040

    SlCKB0Y

    Joined:
    Feb 25, 2012
    Location:
    Sydney, Australia
    #3
    Lol. "Without any other tricks".... except getting root access and the ability to install a kext. o_O
     
  4. newmac2013 thread starter macrumors newbie

    newmac2013

    Joined:
    Jun 4, 2013
    #4
    Rootless prevents editing system files.... so the problem should be fixed
     
  5. SlCKB0Y macrumors 68040

    SlCKB0Y

    Joined:
    Feb 25, 2012
    Location:
    Sydney, Australia
    #5
    Yep, i was just pointing out how crazy the wording is. Personally i'd be an awesome pianist if I had access to a piano, the required discipline and time to learn and the first clue about playing music. o_O
     
  6. Populus macrumors 6502

    Populus

    Joined:
    Aug 24, 2012
    Location:
    Valencia, Spain.
    #6
    Ok, so it's solved on El Capitan.

    By the way, @newmac2013, your avatar is the new spinning ball icon on 10.11? I like it!
     

Share This Page