macOS Mojave vmmap bug deadlocks systems

Objective-See found that running Apple's vmmap utility against launchd (pid 1) freezes any macOS Mojave system, requiring a hard reboot.

Objective-See's Patrick Wardle documents a denial-of-service bug in Apple's built-in vmmap utility, introduced in macOS Mojave (10.14), that was discovered while investigating why his TaskExplorer tool caused full system hangs. TaskExplorer relies on vmmap to enumerate loaded dylibs in remote processes after Apple blocked third-party tools from obtaining task ports via task_for_pid. The root cause: when vmmap is run against launchd (pid 1), it suspends the process to snapshot its memory, then attempts to symbolicate memory regions via the private CoreSymbolication framework, which issues an XPC call (_xpc_look_up_endpoint for com.apple.coresymbolicationd) that must be serviced by launchd. Since launchd is suspended, the XPC call blocks indefinitely, launchd is never resumed, and the entire OS deadlocks, forcing a hard reboot.

This is not an attacker-exploitable vulnerability but a reliability/QA flaw in an Apple-signed utility that has the com.apple.system-task-ports entitlement needed to inspect other processes' memory. The bug only affects Mojave and later; earlier macOS/OSX versions fail gracefully with an 'Invalid connection' error instead of deadlocking. The author reported the issue to Apple and worked around it in TaskExplorer by skipping launchd when enumerating dylibs on Mojave and above. The piece also references CVE-2018-4403, a prior finding from the same tool involving an entitled Apple process (com.apple.dock.extra) loading untrusted third-party dylibs, illustrating a broader pattern of macOS processes inheriting entitlements when hijacked via dylib loading.

Source reporting: https://objective-see.org/blog/blog_0x3E.html