VORANT. Threat Intelligence Sign in Get the full feed

macOS pid-reuse bug enables root via fbahelperd

elevated vulnerability technology

A pid-reuse race condition in macOS's fbahelperd XPC service lets local attackers bypass code-signature checks and escalate to root before macOS 10.14.4.

This Objective-See research (part two of a series) details a macOS privilege-escalation technique exploiting IPC servers that validate client legitimacy using process ID (PID) rather than the more robust audit_token_t. Because PIDs can be reused after a process exits, an unprivileged attacker can spawn a flood of child processes to win a race condition, causing a privileged XPC service to validate a malicious client against a stale, reused PID. The author demonstrates this against com.apple.appleseed.fbahelperd, the privileged Feedback Assistant helper daemon, using posix_spawn with suspended child processes as a reliable technique to win the race.

Once the PID-check bypass is achieved, the researcher chains it with an arbitrary-file-copy primitive in the daemon's copyLogFiles: method (bypassable via path traversal) and further vulnerabilities including CVE-2019-8513 (a TimeMachine helper command injection) and a missing /usr/local/bin/netdiagnose directory abused via runMobilityReportWithDestination:, to achieve root code execution within milliseconds. The researcher notes this exact zero-day was used to win a flag at the 35C3 CTF. A related audit_token integrity issue (CVE-2019-8565, tied to unsafe pid-version incrementing during execve) is also referenced as compounding the risk of PID-based trust checks.

Apple fixed the underlying issue in macOS 10.14.4 and iOS 12.2, but the write-up notes macOS 10.14.3 and earlier remain fully exploitable, and proof-of-concept code has been publicly released. This is a local privilege-escalation research disclosure rather than an in-the-wild campaign, aimed at Apple developers and macOS security researchers to encourage moving away from insecure PID-based IPC trust checks toward audit tokens.

Mentioned in this report

Vulnerabilities CVE-2019-8513weaponizedCVE-2019-8565weaponized

Detection guidance

Suspicious posix_spawn with Process Suspension for PID Reuse Exploitation

ATT&CK T1068

Detects posix_spawn calls with POSIX_SPAWN_SETPGROUP and process suspension flags characteristic of PID-reuse race-condition exploitation against privileged IPC services. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious posix_spawn with Process Suspension for PID Reuse Exploitation
description: Detects unprivileged processes spawning multiple suspended child processes
  via posix_spawn with flags (POSIX_SPAWN_SETPGROUP, POSIX_SPAWN_START_SUSPENDED)
  indicative of winning a race condition against PID-based IPC trust checks. This
  pattern is rare in legitimate macOS applications.
tags:
- attack.privilege-escalation
- attack.t1068
- attack.t1055
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /posix_spawn
    CommandLine|contains|all:
    - POSIX_SPAWN_SETPGROUP
    - POSIX_SPAWN_START_SUSPENDED
  filter_legitimate:
    Image|startswith: /System/Library
  condition: selection and not filter_legitimate
falsepositives:
- Legitimate process-pooling frameworks (rare on macOS) using suspended child processes
- Debuggers or profiling tools spawning processes with suspension for instrumentation
level: high
id: 041d1628-d275-5889-972e-4f3c848f545a
status: experimental
author: Vorant

XPC Service IPC Validation Using Process ID Instead of Audit Token

ATT&CK T1574

Detects privileged XPC services (particularly fbahelperd, mobiledeviced, or TimeMachine helpers) accepting IPC messages validated only by PID rather than audit_token_t, enabling trust-boundary bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: XPC Service IPC Validation Using Process ID Instead of Audit Token
description: Detects privilege-separated XPC daemons (fbahelperd, mobiledeviced, TMHelperAgent)
  validating client legitimacy using only the requesting process's PID rather than
  the cryptographically-bound audit_token_t. This pattern enables unprivileged attackers
  to win a race condition and reuse a stale PID for malicious IPC calls.
tags:
- attack.privilege-escalation
- attack.t1574
- attack.t1068
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|contains|all:
    - com.apple.appleseed.fbahelperd
    CommandLine|contains|all:
    - xpc_connection_get_pid
    - getpid
  filter_system:
    Image|startswith: /System/Library
  condition: selection and not filter_system
falsepositives:
- Older macOS versions (pre-10.14.4) where PID-based IPC was standard practice
- Third-party daemons not yet migrated to audit_token validation
level: high
id: 0ce6a78e-3d89-59d8-a108-df171546e516
status: experimental
author: Vorant

Unprivileged Process Winning PID Reuse Race Against fbahelperd

ATT&CK T1055

Detects an unprivileged process spawning a rapid burst of suspended child processes immediately preceding elevated IPC calls to com.apple.appleseed.fbahelperd or similar privileged XPC services—characteristic of PID-reuse race-condition exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unprivileged Process Winning PID Reuse Race Against fbahelperd
description: Detects an unprivileged user-space process (non-root, non-system) rapidly
  spawning multiple suspended child processes via posix_spawn followed immediately
  by elevated IPC communication with fbahelperd (copyLogFiles:, runMobilityReportWithDestination:).
  This is the hallmark of a PID-reuse race-condition attack exploiting stale PID validation
  in the XPC trust boundary.
tags:
- attack.privilege-escalation
- attack.t1068
- attack.t1055
logsource:
  category: process_creation
  product: macos
detection:
  selection_spawn_burst:
    Image|endswith: /posix_spawn
    CommandLine|contains: POSIX_SPAWN_START_SUSPENDED
  selection_ipc_fbahelperd:
    CommandLine|contains|all:
    - fbahelperd
    - copyLogFiles
  filter_root_system:
    User: root
  filter_system_binary:
    Image|startswith: /System/Library
  condition: (selection_spawn_burst or selection_ipc_fbahelperd) and not filter_root_system
    and not filter_system_binary
falsepositives:
- Process forking frameworks used by legitimate applications (e.g., parallel build
  systems) on older macOS
level: high
id: cccda7ac-19fd-5428-b54e-fe374f407d01
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x41.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free