Endless Exploits: The Saga of a macOS Vulnerability Exploited Seven Times

No ratings

Presented at Objective by the Sea 2024 by

Mickey Jin

How many patches must Apple release, before a vulnerability is truly fixed? The answer, my friend, is “blowin' in the wind” :P In this talk, I will delve into an interesting logic vulnerability discovered in the PackageKit framework on macOS that allows for escalating privileges to root, circumventing the Transparency Consent and Control (TCC), and bypassing the System Integrity Protection (SIP). Many third-party applications are also affected by this vulnerability because of a wrong assumption in the mind of the developers! Even more interesting is the cat-and-mouse game between Apple's patching endeavors and my persistent bypass techniques. It’s hard to believe that Apple released 7 patches in attempts to address the vulnerability before ultimately resolving it. Throughout this epic battle, I managed to harvest a series of CVEs: CVE-2022-26688, CVE-2022-32900, CVE-2023-23497, CVE-2023-27962, CVE-2023-38564, CVE-2023-42853 and CVE-2024-23275. I will discuss each of them in turn, detailing Apple's patches, as well as demonstrating how I've bypassed and exploited them multiple times.