Crash One - A StarBucks Story (CVE-2025-24277)

The speakers met over coffee to compare macOS vulnerability research. Both had independently flagged a flaw in osanalyticshelper, a root daemon that writes crash reports for user processes, and both had judged it unexploitable. Rereading the daemon's sandbox profile revealed a sandbox extension grant that allowed access to any file, which made the bug worth another look. The talk covers how sandbox extensions are issued and consumed over XPC, and how the daemon's callback had to be answered for the crash file to survive.

The central obstacle was a race. On macOS, a rename resolves its source and destination paths separately, so swapping a parent directory for a symlink in a tight loop let them place a file at a location they controlled, though the destination name stayed fixed. They turned that primitive into root by targeting sudoers under /etc/sudoers.d, which does not depend on file names, and by using inheritable ACLs so write access persisted after the file moved. A Python wrapper brute-forced the race until it succeeded.

The speakers then showed a sandbox escape. The daemon could be made to write a disk image without the quarantine attribute, which the system mounts and runs without sandboxing. Chaining this through a screen saver produced a root reverse shell. Apple's fix gated the service behind an entitlement and changed the rename behavior. The takeaway for practitioners is that path-based operations with race windows and ACL inheritance deserve close review on macOS.