Elevating Privileges on macOS by Audit Token Spoofing

Thijs Alkemade, a security researcher at Computest, opens by explaining how XPC is used across Apple's operating systems to split privileges, so that a low-privilege client can ask a more privileged service to act for it. Such services must authorize their callers. Checking process IDs is known to be unsafe, so audit tokens are the usual recommendation. He notes that XPC internals are not publicly documented, so much of his material comes from reverse engineering.

He then walks through how XPC connections are built on Mach messages, which allow many senders to reach one receiver, while XPC assumes a strictly one-to-one link. The audit token stored on a connection is replaced whenever a new message arrives. By routing a second process's messages into the same connection, an attacker can cause a privileged service to check the wrong caller. He demonstrates this against the service management daemon on macOS, getting it to install a privileged helper without a password prompt, which yields root code execution. A second variant abuses forwarded reply ports to race the token update. Apple fixed the specific instance in that daemon, but Alkemade argues the flaw is structural and may exist in other services.

For developers, he recommends checking the caller when a connection is accepted and saving its audit token at that point, dropping messages that lack expected fields, and avoiding per-operation checks that read the live connection token. He also notes that sandbox restrictions on service lookup do not stop connections formed through passed ports.