macOS Mojave vmmap bug deadlocks systems
Objective-See found that running Apple's vmmap utility against launchd (pid 1) freezes any macOS Mojave system, requiring a hard reboot.
Sourceobjective-see.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
Objective-See's Patrick Wardle documents a denial-of-service bug in Apple's built-in vmmap utility, introduced in macOS Mojave (10.14), that was discovered while investigating why his TaskExplorer tool caused full system hangs. TaskExplorer relies on vmmap to enumerate loaded dylibs in remote processes after Apple blocked third-party tools from obtaining task ports via task_for_pid. The root cause: when vmmap is run against launchd (pid 1), it suspends the process to snapshot its memory, then attempts to symbolicate memory regions via the private CoreSymbolication framework, which issues an XPC call (_xpc_look_up_endpoint for com.apple.coresymbolicationd) that must be serviced by launchd. Since launchd is suspended, the XPC call blocks indefinitely, launchd is never resumed, and the entire OS deadlocks, forcing a hard reboot.
This is not an attacker-exploitable vulnerability but a reliability/QA flaw in an Apple-signed utility that has the com.apple.system-task-ports entitlement needed to inspect other processes' memory. The bug only affects Mojave and later; earlier macOS/OSX versions fail gracefully with an 'Invalid connection' error instead of deadlocking. The author reported the issue to Apple and worked around it in TaskExplorer by skipping launchd when enumerating dylibs on Mojave and above. The piece also references CVE-2018-4403, a prior finding from the same tool involving an entitled Apple process (com.apple.dock.extra) loading untrusted third-party dylibs, illustrating a broader pattern of macOS processes inheriting entitlements when hijacked via dylib loading.
Mentioned in this report
Source reporting: https://objective-see.org/blog/blog_0x3E.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs