The Userland Maze — Revealing macOS's Logic Bugs and Security Bypasses

No ratings

Presented at Zer0Con 2024 by

Arsenii Kostromin

My presentation will focus on analyzing vulnerabilities in macOS system components: PackageKit, softwareupdated, and CoreSimulator.framework. During my investigation, I identified critical vulnerabilities that enable local privilege escalation (LPE) from a regular user level to root. Specifically, I discovered that the softwareupdated service improperly allows the installation of any Apple-signed packages, bypassing the intended restrictions for Rosetta 2 installation. This vulnerability (TOCTOU) opens a pathway for attackers to achieve LPE by exploiting these Apple-signed packages. In the CoreSimulator.framework, I found a vulnerability that permits the mounting of dmg images with arbitrary content through the XPC interface, without altering the original root:wheel permissions. This flaw facilitates unauthorized content copying into the CoreSimulator directory, achieving LPE from a regular user level. PackageKit was found to contain multiple vulnerabilities that allow bypassing the System Integrity Protection (SIP) mechanism. My analysis of Apple-signed pkg files, including their installation requirements and scripts, revealed methods to circumvent these requirements and manipulate environment variables during script execution. This research uncovered approximately 6 CVEs capable of SIP bypass. Additionally, I intended to discuss a Sandbox Escape vulnerability, which remains unaddressed by Apple for over a year and a half, highlighting an ongoing security risk.