Breaking the Sound Barrier: Exploiting CoreAudio via Mach Message Fuzzing

No ratings

Presented at CODE BLUE 2025 by

Dillon Franke

This research explores macOS IPC security, specifically focusing on Mach message handlers in system daemons. These handlers, which expose privileged functionality, present a significant attack surface for sandbox escapes and local privilege escalation. I’ll demonstrate how I used structured fuzzing and a technique called API call chaining to uncover vulnerabilities in the coreaudiod system daemon on MacOS. My custom fuzzing harness, dynamic instrumentation, and a blend of static and runtime analysis led to several security flaws, including two major memory corruption bugs. I’ll detail the full exploit chain I developed to leverage one of these for a sandbox escape on modern macOS. I’ll also discuss challenges faced, such as initializing CoreAudio, mocking components, and building targeted grammars for fuzzing. Finally, I’ll share the open-source fuzzing harness and tools developed during this research, aiming to enhance macOS IPC fuzzing accessibility for the security community.