A Deep Dive into A Vulnerability Apple Deems Unexploitable
summary
Finds a narrow race condition in copy APIs in Apple's copyfile/fclone implementation and builds a reliable exploit that uses mounting the destination to force a clone failure, a tight rename-swap loop (renamex with RENAME_SWAP) to flip source between file and symlink, and repeated MD service RPCs to trigger a privileged copy and steal TCC-protected files. Success rate is about 25% originally, falls to ~12.5% after the first patch, and the exploit demonstrably works against the initial patch — this is disclosed as CVE-2024-54566 patched then bypassed and later fixed again; code and demo use an NSFileManager → copyfile fallback path.
AI-written summary · about
chapters (16)
- 0:00Introduction and background
- 1:10Discovery of the vulnerability
- 7:33Why file copy operations matter
- 9:20Confirming the security risk
- 13:39Reproducing the issue in debugger
- 16:57Stable exploitation strategy
- 20:30Real-world exploitation scenarios
- 21:56Targeting the mdwrite service
- 24:05Crafting the exploit payload
- 26:57Demonstrating the exploit
- 27:41Apple's initial patch attempt
- 29:08Bypassing the first patch
- 30:34Apple's second patch
- 31:17Key takeaways for security
- 32:41Advice for red teams
- 33:02Conclusion and Q&A
related talks
36mThe Price of Compatibility: Defeating macOS Kernel Using Extended File Attributes
25mThe Last Line of Defense: Understanding and Attacking Apple File System on iOS
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
36mmacOS Vulnerabilities Hiding in Plain Sight
50mFinding Vulnerabilities In iOS/MacOS Networking Code
54mSubverting Apple Graphics: Practical Approaches to Remotely Gaining Root
37mAttacking The XNU Kernel In El Capitain
40mKnockout Win Against TCC - 20+ NEW Ways to Bypass Your MacOS Privacy Mechanisms