macOS pid-reuse bug enables root via fbahelperd
A pid-reuse race condition in macOS's fbahelperd XPC service lets local attackers bypass code-signature checks and escalate to root before macOS 10.14.4.
Sourceobjective-see.org — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- A public exploit is recorded for CVE-2019-8513 (weaponized) and CVE-2019-8565 (weaponized); no exploitation in the wild is recorded.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
This Objective-See research (part two of a series) details a macOS privilege-escalation technique exploiting IPC servers that validate client legitimacy using process ID (PID) rather than the more robust audit_token_t. Because PIDs can be reused after a process exits, an unprivileged attacker can spawn a flood of child processes to win a race condition, causing a privileged XPC service to validate a malicious client against a stale, reused PID. The author demonstrates this against com.apple.appleseed.fbahelperd, the privileged Feedback Assistant helper daemon, using posix_spawn with suspended child processes as a reliable technique to win the race.
Once the PID-check bypass is achieved, the researcher chains it with an arbitrary-file-copy primitive in the daemon's copyLogFiles: method (bypassable via path traversal) and further vulnerabilities including CVE-2019-8513 (a TimeMachine helper command injection) and a missing /usr/local/bin/netdiagnose directory abused via runMobilityReportWithDestination:, to achieve root code execution within milliseconds. The researcher notes this exact zero-day was used to win a flag at the 35C3 CTF. A related audit_token integrity issue (CVE-2019-8565, tied to unsafe pid-version incrementing during execve) is also referenced as compounding the risk of PID-based trust checks.
Apple fixed the underlying issue in macOS 10.14.4 and iOS 12.2, but the write-up notes macOS 10.14.3 and earlier remain fully exploitable, and proof-of-concept code has been publicly released. This is a local privilege-escalation research disclosure rather than an in-the-wild campaign, aimed at Apple developers and macOS security researchers to encourage moving away from insecure PID-based IPC trust checks toward audit tokens.
Mentioned in this report
Detection guidance
Suspicious posix_spawn with Process Suspension for PID Reuse Exploitation
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects posix_spawn calls with POSIX_SPAWN_SETPGROUP and process suspension flags characteristic of PID-reuse race-condition exploitation against privileged IPC services. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious posix_spawn with Process Suspension for PID Reuse Exploitation
description: Detects unprivileged processes spawning multiple suspended child processes
via posix_spawn with flags (POSIX_SPAWN_SETPGROUP, POSIX_SPAWN_START_SUSPENDED)
indicative of winning a race condition against PID-based IPC trust checks. This
pattern is rare in legitimate macOS applications.
tags:
- attack.privilege-escalation
- attack.t1068
- attack.t1055
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /posix_spawn
CommandLine|contains|all:
- POSIX_SPAWN_SETPGROUP
- POSIX_SPAWN_START_SUSPENDED
filter_legitimate:
Image|startswith: /System/Library
condition: selection and not filter_legitimate
falsepositives:
- Legitimate process-pooling frameworks (rare on macOS) using suspended child processes
- Debuggers or profiling tools spawning processes with suspension for instrumentation
level: high
id: 041d1628-d275-5889-972e-4f3c848f545a
status: experimental
author: Vorant
XPC Service IPC Validation Using Process ID Instead of Audit Token
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects privileged XPC services (particularly fbahelperd, mobiledeviced, or TimeMachine helpers) accepting IPC messages validated only by PID rather than audit_token_t, enabling trust-boundary bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: XPC Service IPC Validation Using Process ID Instead of Audit Token
description: Detects privilege-separated XPC daemons (fbahelperd, mobiledeviced, TMHelperAgent)
validating client legitimacy using only the requesting process's PID rather than
the cryptographically-bound audit_token_t. This pattern enables unprivileged attackers
to win a race condition and reuse a stale PID for malicious IPC calls.
tags:
- attack.privilege-escalation
- attack.t1574
- attack.t1068
logsource:
category: process_creation
product: macos
detection:
selection:
ParentImage|contains|all:
- com.apple.appleseed.fbahelperd
CommandLine|contains|all:
- xpc_connection_get_pid
- getpid
filter_system:
Image|startswith: /System/Library
condition: selection and not filter_system
falsepositives:
- Older macOS versions (pre-10.14.4) where PID-based IPC was standard practice
- Third-party daemons not yet migrated to audit_token validation
level: high
id: 0ce6a78e-3d89-59d8-a108-df171546e516
status: experimental
author: Vorant
Unprivileged Process Winning PID Reuse Race Against fbahelperd
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects an unprivileged process spawning a rapid burst of suspended child processes immediately preceding elevated IPC calls to com.apple.appleseed.fbahelperd or similar privileged XPC services—characteristic of PID-reuse race-condition exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unprivileged Process Winning PID Reuse Race Against fbahelperd
description: Detects an unprivileged user-space process (non-root, non-system) rapidly
spawning multiple suspended child processes via posix_spawn followed immediately
by elevated IPC communication with fbahelperd (copyLogFiles:, runMobilityReportWithDestination:).
This is the hallmark of a PID-reuse race-condition attack exploiting stale PID validation
in the XPC trust boundary.
tags:
- attack.privilege-escalation
- attack.t1068
- attack.t1055
logsource:
category: process_creation
product: macos
detection:
selection_spawn_burst:
Image|endswith: /posix_spawn
CommandLine|contains: POSIX_SPAWN_START_SUSPENDED
selection_ipc_fbahelperd:
CommandLine|contains|all:
- fbahelperd
- copyLogFiles
filter_root_system:
User: root
filter_system_binary:
Image|startswith: /System/Library
condition: (selection_spawn_burst or selection_ipc_fbahelperd) and not filter_root_system
and not filter_system_binary
falsepositives:
- Process forking frameworks used by legitimate applications (e.g., parallel build
systems) on older macOS
level: high
id: cccda7ac-19fd-5428-b54e-fe374f407d01
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x41.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs