Summary

macOS Sequoia 15.3.2 and lower were vulnerable to a local Denial of Service bug via a type confusion leading to a null pointer dereference by abusing the format used to store variables. This happens by setting up the AppleLanguages global variable, using a format for storing strings instead of the format for storing array elements; this causes the crash. The vulnerability can be triggered by opening any macOS application that either uses the AppleLanguages global variable, e.g. System Settings.app, Dock.app or any AppKit-based macOS application.

Explanation

The bug is triggered when the AppleLanguages global variable, which takes arrays as inputs, is set with the syntax that would be used for a string-based variable. The correct way to set this variable is

defaults write -g AppleLanguages '("en_US")', while the vulnerable way is defaults write -g AppleLanguages "en_US".

This value is then stored on the following .plist files:

• $HOME/Library/Preferences/.GlobalPreferences.plist
• $HOME/Library/Preferences/.GlobalPreferences_m.plist

After setting the global variable to any value ("%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n" was used) and upon debugging a process like System Settings.app, the behavior detected is that the CFPreferencesCopyValue function will return the payload as a NSCFString value. Immediately after, count would be called on it with objc_msgSend. This leads to a segmentation fault caused by a null pointer dereference stemming from the ObjC type confusion. Below is an extract of the fault from a crash log, also attached to this report.

"vmRegionInfo" : "0x2aea is not in any region. Bytes before following region: 4305884438\n REGION TYPE START - END [ VSIZE] PRT\/MAX SHRMOD REGION DETAIL\n UNUSED SPACE AT START\n---> \n __TEXT 100a6c000-100ba8000 [ 1264K] r-x\/r-x SM=COW \/System\/Applications\/System Settings.app\/Contents\/MacOS\/System Settings",
"exception" : {"codes":"0x0000000000000001, 0x0000000000002aea","rawCodes":[1,10986],"type":"EXC_BAD_ACCESS","signal":"SIGSEGV","subtype":"KERN_INVALID_ADDRESS at 0x0000000000002aea"},
"termination" : {"flags":0,"code":11,"namespace":"SIGNAL","indicator":"Segmentation fault: 11","byProc":"exc handler","byPid":768},
"vmregioninfo" : "0x2aea is not in any region. Bytes before following region: 4305884438\n REGION TYPE START - END [ VSIZE] PRT\/MAX SHRMOD REGION DETAIL\n UNUSED SPACE AT START\n---> \n __TEXT 100a6c000-100ba8000 [ 1264K] r-x\/r-x SM=COW \/System\/Applications\/System Settings.app\/Contents\/MacOS\/System Settings",
"extMods" : {"caller":{"thread_create":0,"thread_set_state":0,"task_for_pid":0},"system":{"thread_create":0,"thread_set_state":0,"task_for_pid":0},"targeted":{"thread_create":0,"thread_set_state":0,"task_for_pid":0},"warnings":0},

Steps to reproduce

1. Change the AppleLocale global variables with any payload: defaults write -g AppleLanguages "%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n"
2. Open System Settings.app or reload the Dock application from the Apple logo menu. The payload will be executed.

Recovery steps

1. Reboot the device into Recovery Mode
2. Unlock the user and hard drive
3. Remove the following files from:

• /Volumes/Data/Users/username/Library/Preferences/ByHost/com.apple.loginwindow.plist
• /Volumes/Data/Users/username/Library/Preferences/loginwindow.plist
• /Volumes/Data/System/Volumes/Data/private/var/root/Library/Preferences/.GlobalPreferences.plist

4. Shutdown or restart the device.

Expected and vulnerable behavior

Under normal circumstances, the macOS GUI should behave normally and open any AppKit-based application, like System Settings.app. With this bug, an UI corruption happens in form of the Dock application being abruptly terminated, and the UI ending up disabled to any user input after a cold reboot.

Proof of Concept