3 ms·
Then how does the entitlement escalation part of the exploit work? The writeup sure makes it sound like any app can write to the persisted state of another app
by amluto 4y ago
Then how does the entitlement escalation part of the exploit work? The writeup sure makes it sound like any app can write to the persisted state of another app.
- ridiculous_fish 4y agoSandboxed apps cannot write into the container of other apps unless the user explicitly allows it. Here the bug is that OpenAndSavePanelService, which is privileged, was decoding state from the app it was acting on behalf of. An app can save malicious objects into its own serialized state, and then it will be injected into OpenAndSavePanelService, leading to a sandbox escape. The fix is for the service to stop decoding state.