Breaking the Sound Barrier: Exploiting CoreAudio via Mach Message Fuzzing
summary
Fuzzing targets Mac IPC handlers in the Core Audio stack and produces crashes by loading MIG handlers directly from the shared cache, using a direct harness plus harvested real messages; tooling includes tinyinst for symbol resolution and instrumentation and the Jackaloupe fuzzer for coverage‑guided mutation. Research finds ~63 MIG handlers, a shallow type confusion in coreaudiod that yields RCE on Intel via heap spraying with plist CF objects, reported Oct 9 2024 and fixed Dec 11 2024.
AI-written summary · about
chapters (29)
- 0:00Introduction
- 1:31What is fuzzing
- 3:37Attack cycle
- 4:44Interprocess communication
- 6:09Mach ports basics
- 7:55CoreAudio as target
- 9:18Sandbox access
- 11:30CoreAudio reverse engineering
- 11:50Fuzzing harness
- 13:36Mock API vs direct
- 15:43Finding handlers
- 17:27Extracting framework
- 18:10MIG subsystems
- 19:52Calling handlers
- 21:20Corpus harvesting
- 22:24Fuzzing with Jackalope
- 23:30Harness iteration
- 24:12Target initialization
- 25:16API call chaining
- 27:22Mocking irrelevant
- 29:08Type confusion exploit
- 34:30Exploitation challenges
- 37:19Unlimited retries
- 37:40Property lists
- 38:44Indirect pointer chains
- 41:10Privilege escalation demo
- 42:36CVE-2025-31235 double free
- 43:18Resources
- 43:40Key takeaways and closing remarks
related talks
53mFuzzing At Mach Speed: Uncovering IPC Vulnerabilities On MacOS
49mDrill Apple Core: Up and Down - Fuzz Apple Core Component in Kernel and User Mode for Fun and Profit
43mDebug for Bug: Crack and Hack Apple Core by Itself
40m(P)FACE into the Apple core and exploit to root
27mNew Attack Surface in Safari: Using Just One Web Audio Vulnerability to Rule Safari
53mResearching New Attack Interfaces On iOS And OSX
36mThe Price of Compatibility: Defeating macOS Kernel Using Extended File Attributes
35mRacing the Dark: A New TOCTTOU Story From Apple's Core