2 ms·
Yes of course, by design apps write their state into their own sandbox in the filesystem, and trust the OS to enforce security boundaries.
by ridiculous_fish 4y ago
Yes of course, by design apps write their state into their own sandbox in the filesystem, and trust the OS to enforce security boundaries.
- amluto 4y agoThen how does the entitlement escalation part of the exploit work? The writeup sure makes it sound like any app can write to the persisted state of another app.
- ridiculous_fish 4y agoSandboxed apps cannot write into the container of other apps unless the user explicitly allows it. Here the bug is that OpenAndSavePanelService, which is privileged, was decoding state from the app it was acting on behalf of. An app can save malicious objects into its own serialized state, and then it will be injected into OpenAndSavePanelService, leading to a sandbox escape. The fix is for the service to stop decoding state.