The Patching Friars' AlmanacA calendar of CVE saints

October 29

LightspeedHoly card for lightspeed, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 Lightspeed CITIUS QUAM CUSTOS
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint Lightspeed, Who Outran the Sandbox

Patron of iOS and macOS sandboxes, kernel race conditions, and whoever reaches the finish line first.

Life

In October 2018 Luca Moro of Synacktiv described Lightspeed, a vulnerability in Apple's XNU kernel: a memory corruption reachable from inside the sandbox let you escape it and escalate privileges on iOS and macOS. It was a race against time, won by exploiting a race condition before the system could notice. Apple fixed it with iOS 12 and macOS Mojave 10.14.

Prayer

O Saint Lightspeed, who beats the kernel's defences to the clock, let our sandboxes stay faster than the escapers. Amen.

How to celebrate

Celebrated by updating to iOS 12 or macOS Mojave 10.14 and keeping the system always on the latest version.

First to the memory sets the rules.

Technical record

Disclosed on
October 29 2018
CVE
CVE-2018-4344
CVSS
7.8Actively exploited (CISA KEV)
Product
Apple · iOS, macOS, tvOS, watchOS

A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.

Sources: synacktiv.com

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.