CVE-2018-4054

An attacker with local access to the machine sends an XPC message to the helper service (which runs as root) with message ID 0x101D3. The message contains an XPC array named "argv" whose elements are copied into an internal structure and passed to the Launch function [ref_id=1]. Because the Dispatch function does not check the caller's identity, any local user can invoke this code path and cause the root-privileged helper to execute an arbitrary binary of the attacker's choosing, thereby escalating privileges to root [CWE-19].

The vulnerability resides in the Dispatch function of the install helper tool for Pixar Renderman 22.2.0 on Mac OS X. The helper tool is installed and launched as root and continues listening after installation completes. The relevant code path handles XPC message ID 0x101D3, where it reads an XPC array named "argv" from the message and passes it to a Launch function without verifying the caller's identity [ref_id=1].

The advisory states that the vendor patched the issue on 2018-12-11, but no patch diff is included in the bundle [ref_id=1]. The remediation would require the Dispatch function to validate the identity or authorization of the caller before processing XPC message ID 0x101D3 and launching the requested binary. Without such a check, any local user can abuse the root-privileged helper to execute arbitrary commands.

The advisory includes a C source file and a Python script as proof of concept. The Python script should be made executable and placed at /tmp/root.py. The attacker runs `nc -l 1337` in a separate window to accept the root shell, then triggers the exploit to escalate privileges to root [ref_id=1].