Apple Mac OS X Mach Port Inheritance Privilege Escalation Vulnerability
19 Nov. 2007
Summary
Mach ports are used to provide inter-process communication (IPC) facilities on Mac OS X.
Local exploitation of an access validation vulnerability in Apple Inc.'s Mac OS X could allow an attacker to execute arbitrary code with root privileges.
Vulnerable Systems:
* Mac OS X version 10.4.10, both Server and Workstation.
* (Previous versions may also be affected.)
When executing a setuid-root binary, the Mach kernel does not reset the current thread Mach port, or the current thread Mach Exception Port. By first creating and obtaining write access to a Mach port, and then executing a set-uid root binary, an attacker can write arbitrary data into the address space of the process running as root. This leads to arbitrary code execution in the privileged process.
Successful exploitation of this vulnerability results in the execution of arbitrary code with root privileges. All an attacker needs is a setuid-root binary and permission to execute it. In a default install, there are numerous binaries that meet these requirements.
