Breaking the Sound Barrier: Exploiting CoreAudio via Mach Message Fuzzing

The talk looks at macOS inter-process communication, focusing on Mach message handlers that system daemons expose as RPC-style interfaces. The speaker argues these handlers are an overlooked attack surface, since they can offer a route from a sandboxed application such as a browser to privileged code. The target chosen was coreaudiod, selected because it is large, is reachable from high-value sandboxed applications, and ships as closed-source binaries.

The approach is a knowledge-driven fuzzing workflow: enumerate sandbox-allowed Mach services, pull the framework out of the dyld shared cache, locate the MIG server routines, and call the handlers directly from a harness in the same process. Early crashes were mostly harness mistakes, such as missing daemon initialization, unrelated stateful dependencies, and a null dereference that blocked progress. Coverage data guided fixes, and an API call chaining technique let the fuzzer run sequences of handler calls rather than single messages.

The fuzzing surfaced a type confusion in the hardware abstraction layer, where a user-supplied ID led to an object lookup without a proper type check. The speaker explained how uninitialized heap memory and property list spraying were used to build a pointer chain toward controlled data, and how a daemon restart gave repeated attempts. The live demo did not succeed on stage. Takeaways: stateful services need structured fuzzing, and stricter type checks are the fix; the speaker said the harness and tooling were released open source.