Abstract

In the macOS system, most processes are running in a restricted sandbox environment, whether they are Apple's own services or third-party applications. Consequently, once an attacker gains Remote Code Execution (RCE) from these processes, their capabilities are constrained. The next step for the attacker is to circumvent the sandbox to gain enhanced execution capabilities and broader file access permissions.

But how to discover sandbox escape vulnerabilities? Upon reviewing the existing issues, I unearthed a significant overlooked attack surface and a novel attack technique. This led to the discovery of multiple new sandbox escape vulnerabilities: CVE-2023-27944, CVE-2023-23414, CVE-2023-32404, CVE-2023-41077, CVE-2023-42961, and CVE-2024-27864. Additionally, there are two other vulnerabilities affecting only beta versions that have been resolved and rewarded, but no specific CVE numbers have been assigned. There are three more sandbox escape issues currently awaiting processing by Apple’s security team.

In this presentation, I will delve into each of these new vulnerabilities - discussing their root causes while demonstrating how they can be exploited and explaining how Apple addressed them.