Running a parser for a network protocol as root seems like a pretty unnecessarily dumb thing to do. I can't really imagine why any part of airplay would need to run as root; maybe something to do with DRM? Although the DRM daemon `fairplayd` runs as a limited-privilege user `_fpsd`, so maybe not. So bizarre that Apple makes all these cool systems to sandbox code, and creates dozens of privilege-separated users on macOS, and then runs an HTTP server doing plists parsing as an unsandboxed root process.
throw0101a 13 hours ago [-]
CVE-2025-24252 and CVE-2025-24132 are two examples. Doing a search for "Oligo" in release notes gives various other results, e.g.,
Apple fixed their stuff, but third-parties who used their SDK will have to issue updates as well.
m463 3 hours ago [-]
macos is pretty promiscuous, and I've noticed random airplay displays (like the neighbors) showing up in the mirroring dropdown in the dock.
wonder if this is a way to get into the stack.
abhisek 10 hours ago [-]
Very curious about the exploitation of CVE-2025-24252, a use-after-free (UAF) using which they achieved zero-click RCE on MacOS. This is inspite of ASLR and heap exploitation mitigations in place to mitigate such vulnerability classes
On ASLR: you might use the UAF to access memory regions you shouldn’t have access to. By reading the contents, they can potentially leak pointers to a critical library (e.g., libc), allowing them to calculate the offsets to bypass ASLR.
On heap protection: if you spray the heap with predictable data patterns you can improve your chance of landing a useful address, even with ASLR in place
browser1 8 hours ago [-]
[dead]
rubatuga 6 hours ago [-]
Good thing I'm still on macOS 12
slama 5 hours ago [-]
macOS 12 is EOL and is no longer receiving security updates.
* https://support.apple.com/en-ca/122374
Apple fixed their stuff, but third-parties who used their SDK will have to issue updates as well.
wonder if this is a way to get into the stack.
https://security.apple.com/blog/towards-the-next-generation-...
On heap protection: if you spray the heap with predictable data patterns you can improve your chance of landing a useful address, even with ASLR in place
There’s a strong chance it’s vulnerable, too