macOS Privilege Escalation Via Traceroute6

Paweł Płatek walks through a user-to-root local privilege escalation exploit for macOS that chains four bugs across mDNSResponder, traceroute6 and libinfo. The story starts with an overflow in traceroute's host lookup that crashes the tool but is blocked by stack protections. Following the lookup into libinfo, the research shows the local DNS client can be redirected to an attacker-controlled socket, exposing a parser where a counter wraps and writes before a buffer.

Turning this into a heap underflow required changing how libmalloc lays out memory, since the overflow otherwise lands in unmapped space. Allocating and freeing a large block forces the heap to grow downward. A privilege-dropping mistake in traceroute6, where the effective UID is set before the real UID, lets the process restore root. Platform libraries are randomized only once per boot, so a function pointer can be located from inside the process. On Apple silicon the heap sits closer to metadata, and a region-trailer technique is used to reach a control pointer.

The last hurdle is pointer authentication. Platform binaries share a signing key, so the exploit uses an Apple-signed tool with protections disabled to sign a pointer on its behalf. The talk closes with three takeaways: the region-trailer technique for libmalloc, a refresher on setuid pitfalls, and a way to bypass PAC in local exploits.