4 ms·
Oh that hurts to watch, brutal. The "Pwn" button helps keep it light, and I'm definitely stealing that, but ouch. Can someone who knows mac OS development educ
by benreesman 4y ago
Oh that hurts to watch, brutal. The "Pwn" button helps keep it light, and I'm definitely stealing that, but ouch.
Can someone who knows mac OS development educate me about why it would be broken/expensive/inadequate to just page the application's mapped pages to disk? I gather at least on the lower memory Apple Silicon devices that swap is pretty aggressive even for running applications?
- ridiculous_fish 4y agoI worked on AppKit's persistent state feature. One of its primary uses is persisting UI state across app restarts, for example when performing a software update. Simply writing out memory to disk would "persist" data like Mach ports or file descriptors, which would no longer be valid when the app is re-launched.
- benreesman 4y agoMakes sense! Thanks for the explanation.
- amluto 4y agoWould it be practical to prevent apps from writing to other apps’ persisted state?
- ridiculous_fish 4y agoYes of course, by design apps write their state into their own sandbox in the filesystem, and trust the OS to enforce security boundaries.
- amluto 4y agoThen how does the entitlement escalation part of the exploit work? The writeup sure makes it sound like any app can write to the persisted state of another app.
- ridiculous_fish 4y agoSandboxed apps cannot write into the container of other apps unless the user explicitly allows it. Here the bug is that OpenAndSavePanelService, which is privileged, was decoding state from the app it was acting on behalf of. An app can save malicious objects into its own serialized state, and then it will be injected into OpenAndSavePanelService, leading to a sandbox escape. The fix is for the service to stop decoding state.
- Tagbert 4y agoIsn’t that what happens when it goes into sleep mode?
- benreesman 4y agoYou most likely meant to ask any questions about deep lore Apple internals to the sibling, who is a super well-known expert on the topic. I barely know my way around XCode. :)
- valleyer 4y agoYes, but that persists the entire system, including the kernel. AppKit's restorable state is meant to be consumed by brand new processes.