Revisiting Apple IPC: (1) Distributed Objects

Summary: Google Project Zero's Ian Beer detailed a set of bugs in Apple's Distributed Objects IPC mechanism, including CVE-2015-5784 in the setuid-root Install.framework 'runner' executable, which creates 'Library/Receipts' directories as root on request. Because the makeReceiptDirAt:asRoot: method never verified that its path argument was a real NSString rather than an attacker-supplied proxy object, a local user could pass a fake object whose stringByAppendingPathComponent callback returned controlled values, reaching mkdir, unlink and chown with controlled arguments.
What's compelling: The bug lived in a setuid-root helper that temporarily drops privileges and then regains EUID 0 when the asRoot flag is set, so a local attacker's proxy callbacks ran while the process held root. Apple's fix was a single [pathArg isProxy] check at the top of the function, a reminder that weakly typed Objective-C parameters crossing an IPC boundary can hand an attacker control of privileged file operations.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026