macOS pid-reuse bug enables root via fbahelperd

A pid-reuse race condition in macOS's fbahelperd XPC service lets local attackers bypass code-signature checks and escalate to root before macOS 10.14.4.

This Objective-See research (part two of a series) details a macOS privilege-escalation technique exploiting IPC servers that validate client legitimacy using process ID (PID) rather than the more robust audit_token_t. Because PIDs can be reused after a process exits, an unprivileged attacker can spawn a flood of child processes to win a race condition, causing a privileged XPC service to validate a malicious client against a stale, reused PID. The author demonstrates this against com.apple.appleseed.fbahelperd, the privileged Feedback Assistant helper daemon, using posix_spawn with suspended child processes as a reliable technique to win the race.

Once the PID-check bypass is achieved, the researcher chains it with an arbitrary-file-copy primitive in the daemon's copyLogFiles: method (bypassable via path traversal) and further vulnerabilities including CVE-2019-8513 (a TimeMachine helper command injection) and a missing /usr/local/bin/netdiagnose directory abused via runMobilityReportWithDestination:, to achieve root code execution within milliseconds. The researcher notes this exact zero-day was used to win a flag at the 35C3 CTF. A related audit_token integrity issue (CVE-2019-8565, tied to unsafe pid-version incrementing during execve) is also referenced as compounding the risk of PID-based trust checks.

Apple fixed the underlying issue in macOS 10.14.4 and iOS 12.2, but the write-up notes macOS 10.14.3 and earlier remain fully exploitable, and proof-of-concept code has been publicly released. This is a local privilege-escalation research disclosure rather than an in-the-wild campaign, aimed at Apple developers and macOS security researchers to encourage moving away from insecure PID-based IPC trust checks toward audit tokens.

Source reporting: https://objective-see.org/blog/blog_0x41.html