Multiple new macOS sandbox escape vulnerabilities (jhftss.github.io)

Article summary

A researcher has discovered multiple new sandbox escape vulnerabilities in macOS, allowing attackers to gain enhanced execution capabilities and broader file access permissions. The vulnerabilities exist in XPC services, which are used for inter-process communication, and can be exploited by sandboxed applications. The researcher found that many XPC services are reachable from sandboxed applications, despite being intended to be private. The vulnerabilities have been reported to Apple and some have been patched.

Main themes

• macOS sandbox vulnerabilities
• XPC services
• Sandbox escape techniques
• Apple security
• Inter-process communication

What commenters say

• The design of the macOS sandbox and XPC services may be flawed, allowing for these vulnerabilities to exist.
• The vulnerabilities are a result of workarounds and compromises made to retrofit the sandbox into macOS, rather than a fundamental design issue.
• The Mach layer of XNU is not the cause of these vulnerabilities, despite some claims to the contrary.
• The use of process injection is a common and problematic practice on Windows, which can lead to security issues.
• The discovery of these vulnerabilities highlights the importance of reviewing and testing the security of XPC services and the macOS sandbox.
• Some commenters disagree on the significance of the vulnerabilities and the effectiveness of the patches, with some arguing that the issues are not as severe as claimed.