Compromising the macOS Kernel through Safari by Chaining Six Vulnerabilities

Overview: Security researchers from Georgia Tech's Systems Software and Security Lab (SSLab / Team Rudimentary), presenting at Black Hat USA, detail their winning Pwn2Own 2020 exploit chain against Apple macOS. The authors demonstrate how they achieved full remote code execution in the macOS kernel from an unprivileged Safari browser visit by chaining six distinct zero-day vulnerabilities. The presentation outlines their discovery methodologies, root-cause vulnerability analyses, sandbox escape techniques, and multiple privilege escalation stages that systematically dismantle Apple's security architecture and System Integrity Protection (SIP).

Key Topics: - Exploiting JavaScriptCore (JSC) JIT compiler optimization flaws for initial browser remote code execution - Escaping the Safari WebProcess sandbox via CVMServer heap overflow and Mach task port hijacking - Bypassing first-time application execution protections and abusing Safari's broker process - Local privilege escalation to root via `cfprefsd` symlink races and kernel code execution through `kextload` TOCTOU

Technical Details: The exploit chain initiates with Bug 1, an RCE in Safari's JavaScriptCore JIT compiler caused by incorrect side-effect modeling of the `in` operator. While treated as side-effect free during JIT optimization passes, embedding a PDF triggers lazy plugin initialization upon evaluating `in`, firing a `DOMSubtreeModified` event. The researchers registered an event handler to alter an array's type from double to contiguous, inducing type confusion. This provided `addrof` and `fakeobj` primitives, bypassed randomized Structure IDs, and corrupted the butterfly structure to overwrite JIT memory with shellcode. To escape the sandbox, the team chained Bug 2 (abusing Safari's broker process invoking `select` to pop Finder via `LSOpenURLsWithRole_Common`) with Bug 3, a heap buffer overflow in `cvmsServer` (a Mach service accessible from the sandbox). By exploiting integer underflow during size calculation, they overwrote a heap-allocated Mach VM port, coerced message ID 7 into returning `cvmsServer`'s task port, and achieved code execution in `cvmsServer`.

To achieve persistent execution outside the sandbox, the researchers bypassed Apple's first-time app execution quarantine (Bug 4). Discovering that macOS places unconfirmed downloaded applications into a suspended state pending user dialog confirmation, they resumed the process by simply sending a `SIGCONT` signal from their compromised context. Next, they escalated from unprivileged user to root via Bug 5, a race condition in Core Foundation's preference daemon (`cfprefsd`). By swapping directories with a symbolic link between `mkdir()` and `chmod()`/`chown()`, they coerced `cfprefsd` into granting the unprivileged user write ownership over `/etc/pam.d/login`, allowing them to inject `pam_permit.so` and spawn a passwordless root shell. Finally, they achieved kernel code execution and bypassed System Integrity Protection (SIP) via Bug 6, exploiting a TOCTOU race condition in the setuid `kextload` binary between signature verification and kernel module staging, ultimately loading an unsigned kernel extension into ring 0.

Key Takeaways: Complex modern operating system compromises rely on multi-stage vulnerability chains that weaponize subtle architectural gaps between sandboxed clients and privileged background daemons. Defensive teams must eliminate unsafe file path operations in privileged helper services by utilizing file descriptors (`openat`, `fchown`) instead of string paths to neutralize symlink races. Furthermore, platform architects must ensure that security UI prompts are backed by kernel-enforced execution blocks rather than resumable process states, and mandate hardware-enforced pointer authentication (PAC) across all user-to-kernel communication interfaces.

(AI summary — Gemini Flash)