Mac OS X Networkd XPC Type Confusion Sandbox Escape
Posted by deepcore on November 17, 2015 – 1:07 pm
networkd is the system daemon which implements the com.apple.networkd XPC service. It’s unsandboxed but runs as its own user. com.apple.networkd is reachable from many sandboxes including the Safari WebProcess and ntpd (plus all those which allow system-network). networkd parses quite complicated XPC messages and there are many cases where xpc_dictionary_get_value and xpc_array_get_value are used without subsequent checking of the type of the returned value.
Post a reply
You must be logged in to post a comment.