[Found a] heap underwrite vulnerability in XNU’s dlil.c (which handles network interfaces) caused by an (uint16_t) integer overflow in if.c. This can be triggered by a root user creating 65536 total network interfaces.
[…]
From what I can tell, it seems the vulnerable code was introduced in XNU 517.3.7, Mac OSX 10.3.2, released on December 17th, 2003, making it a 19-year-old bug!
[…]
Ultimately I gave up, sent what I had to Apple, and moved on to the next bug (but I did learn a lot in the process).
That’s the unmistakable voice of a pure academic.
XNU is used in Apple’s laptops, phones, tablets, watches, TV… and the company quickly rolled the trivial fix into a January 23rd release of iOS 16.3 and iPadOS 16.3 including a rather important impact detail.
Kernel
Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: The issue was addressed with improved memory handling.
Tesla’s SEC public disclosure filings have revealed that it received requests from the DOJ (US Department of Justice) for documents related to “Autopilot and FSD” (Full of Shit Driving) features.
Tesla has a long habit of doing exactly what everyone says is wrong.
One example is that when the U.S. government was cracking down on VW for diesel emissions… Tesla acquired giant dirty diesel generators to power its regressive charging stations as the future of “environmental” electric cars. It was disinformation.
Nobody stopped them.
Another example is when an owner tried to sue the company after he fell asleep and killed a cyclist, Tesla announced it was soon deploying Autopilot for owners to be able to fall asleep. It was disinformation.
Nobody stopped them.
And so the obvious question, given serial liars who for over a decade have flagrantly ignored pubic safety for self-enrichment, is where does the buck stop in America… if ever?
In 2016 I gave expert security presentations to show how dangerous and deceptive Tesla was while not being regulated adequately. Such a low quality car company with harmful engineering standards should have had their product grounded back then.
Much to his surprise, @preneh24 reports that the steering wheel of his new Tesla Model Y came off while he and his family were traveling on the freeway…. “We lost trust in Tesla and would greatly appreciate this car be taken back and full refund be issued. I feel safety is more important than tech car,” he wrote in the tweet.
Fact: safety versus tech car is a false choice. Many tech cars are safe. Tesla is neither a tech car nor safe.
It has been clear for almost a decade that many more people would die from the Tesla fraud, cynically self-described by them as having “fun” tricking people into unnecessary risks (the CEO referred to NHTSA anti-fraud work as the “fun police“).
Bogus “Driverless” and bogus “Autopilot” and bogus “Full Self Driving” all were a key element to the false promise of safety, which they might as well have declared would cure pandemics, poverty and world hunger too.
…like making Big Macs a mandatory part of all grade-school lunches because the CEO of McDonald’s says he dreams of the Big Mac one day preventing cancer.
Apparently people now are shocked to hear a Tesla engineer testify in a wrongful death case: his CEO intentionally decieved customers about safety with grossly doctored evidence to juice sales/stock and ruin market competition.
Anyone worried about “deep fakes” in 2023 should be looking at Tesla PR since 2016.
The decision to advertise partial lane assist with serious safety flaws as FULL Self Driving when it was well known to be on the complete opposite end of automation (barely Level 2), was a callous disregard for human life.
How could any of this still be a surprise? That’s the power of disinformation.
Americans serving jury duty eventually became so offended by evidence of Ford downplaying the significance of deadly vehicle fires (an obvious and odious failure of “self-regulation”) that punitive and even criminal charges were floated against the car maker.
Tesla is long overdue for punitive and even criminal charges.