Researchers Demonstrate Mac OS Privilege Escalation and Sandbox Escape in CVE-2025-24277
· 24:46 · Watch on YouTube ↗
Summary
At Hexacon 2025, Csaba Fitzl and Gergely Kalman demonstrated how a race condition in Mac OS OS analytics helperd could enable local privilege escalation and a sandbox escape. Apple patched the issue with entitlement and symlink-handling checks.
Key points
- The researchers described a flaw in the root-running OS analytics helperd, which creates process crash logs.
- They used a sandbox extension sent over XPC to give the helper broader file-system access.
- A race during a rename operation let them place a file in a system location; ACL behavior enabled a sudo configuration that permitted passwordless privilege escalation.
- They also demonstrated a sandbox escape by having the helper create a disk image that launched an unsandboxed application, then chained that to a root shell.
- Apple added an entitlement check for XPC communication with the helper and changed the rename operation to avoid following symbolic links.
- The talk identifies the issue as CVE-2025-24277.
Article Details
- Topics
- [01:47] Crash-log handling by OS analytics helperd and the initial file-system access problem
- [04:17] Sandbox extensions, XPC messaging, and granting the helper expanded access
- [10:10] Exploiting a rename race to place a file in a system location
- [14:51] Using ACL behavior and sudo configuration for privilege escalation
- [18:48] Chaining the helper's file creation behavior into a Mac OS sandbox escape
- [23:18] Apple's entitlement and symlink-handling fixes