privilege-escalation-methodendpoint-software-vulnerabilitypatch-regressionproof-of-concept-release

Apple CVMServer Patch Introduced Root-Level Sandbox Escape on macOS

Attack Tradecraft · 2 sources · Updated 4mo ago · First seen Jun 16, 2022

Researchers reported that Apple’s fix for CVE-2021-30724 in the root-privileged CVMServer daemon introduced a new flaw, tracked as CVE-2022-26721, that could be reached from the Safari renderer sandbox on macOS. The bug stemmed from uninitialized cleanup metadata left behind when a bounds check aborted processing, creating a path for attacker-controlled munmap operations on arbitrary memory pages inside the service.

Theori showed the issue could be turned into root code execution by shaping heap contents, using a binary-search-style oracle to infer CVMServer memory layout, and overwriting dyld private-memory function pointers. A proof of concept reportedly read /var/db/SystemKey, which can be used to decrypt macOS keychain files, underscoring the impact of the sandbox escape and privilege-escalation chain. Apple addressed the vulnerability in macOS 12.4 by replacing malloc with calloc to ensure the descriptor buffer was zero-initialized.

Who uses this technique?Get the actors, campaigns, and ATT&CK mapping behind it.

Get the tradecraft

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Jun 3, 2021 – Jun 16, 2022

Jun 16, 20224y ago
Apple fixes CVE-2022-26721 in macOS 12.4
Theori stated that Apple fixed CVE-2022-26721 in macOS 12.4 by replacing malloc with calloc to zero-initialize the descriptor buffer. This addressed the uninitialized memory condition in CVMServer.
Binary-searching into CVMServer - Theori BLOG
Jun 16, 20224y ago
Apple's CVE-2021-30724 patch introduces CVE-2022-26721
Theori reported that Apple’s patch for CVE-2021-30724 introduced CVE-2022-26721, an uninitialized memory flaw in the root-privileged CVMServer daemon on macOS. The bug left cleanup metadata uninitialized when a bounds check triggered a break, enabling attacker-controlled munmap calls on arbitrary memory pages.
Binary-searching into CVMServer - Theori BLOG
Jun 16, 20224y ago
Theori publishes exploitation details and PoC for CVE-2022-26721
On June 16, 2022, Theori published technical analysis showing how CVE-2022-26721 could be exploited from the Safari renderer sandbox to achieve root code execution. The proof of concept demonstrated reading /var/db/SystemKey, which could be used to decrypt macOS keychain files.
Binary-searching into CVMServer - Theori BLOG
Jun 3, 20215y ago
Apple patches CVE-2021-30724 in CVMServer
Trend Micro reported CVE-2021-30724, a CVMServer vulnerability affecting macOS and iOS, in research published on June 3, 2021. The later Theori analysis states Apple’s fix for this issue introduced a new bug.
CVE-2021-30724: CVMServer Vulnerability in macOS and iOS

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Privilege Escalation via Memory Initialization in macOS (CVE-2022-26721)

Affected products

1 linked

Macos

Organizations

1 linked

Apple

Do you run this?Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.

See Who Uses This Technique

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Theori BlogNews · Jun 16, 2022

Binary-searching into CVMServer - Theori BLOGOpen source ↗

Trend Micro ResearchNews · Jun 3, 2021

CVE-2021-30724: CVMServer Vulnerability in macOS and iOSOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

privilege-escalation-methodendpoint-software-vulnerabilitypatch-regressionproof-of-concept-release

Apple CVMServer Patch Introduced Root-Level Sandbox Escape on macOS

Attack Tradecraft · 2 sources · Updated 4mo ago · First seen Jun 16, 2022

Who uses this technique?Get the actors, campaigns, and ATT&CK mapping behind it.

Get the tradecraft

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Jun 3, 2021 – Jun 16, 2022

Jun 16, 20224y ago
Apple fixes CVE-2022-26721 in macOS 12.4
Theori stated that Apple fixed CVE-2022-26721 in macOS 12.4 by replacing malloc with calloc to zero-initialize the descriptor buffer. This addressed the uninitialized memory condition in CVMServer.
Binary-searching into CVMServer - Theori BLOG
Jun 16, 20224y ago
Apple's CVE-2021-30724 patch introduces CVE-2022-26721
Theori reported that Apple’s patch for CVE-2021-30724 introduced CVE-2022-26721, an uninitialized memory flaw in the root-privileged CVMServer daemon on macOS. The bug left cleanup metadata uninitialized when a bounds check triggered a break, enabling attacker-controlled munmap calls on arbitrary memory pages.
Binary-searching into CVMServer - Theori BLOG
Jun 16, 20224y ago
Theori publishes exploitation details and PoC for CVE-2022-26721
On June 16, 2022, Theori published technical analysis showing how CVE-2022-26721 could be exploited from the Safari renderer sandbox to achieve root code execution. The proof of concept demonstrated reading /var/db/SystemKey, which could be used to decrypt macOS keychain files.
Binary-searching into CVMServer - Theori BLOG
Jun 3, 20215y ago
Apple patches CVE-2021-30724 in CVMServer
Trend Micro reported CVE-2021-30724, a CVMServer vulnerability affecting macOS and iOS, in research published on June 3, 2021. The later Theori analysis states Apple’s fix for this issue introduced a new bug.
CVE-2021-30724: CVMServer Vulnerability in macOS and iOS

Linked entities