BREAKING THE SOUND BARRIER PART I: FUZZING COREAUDIO WITH MACH MESSAGES

Summary from the TLDR InfoSec newsletter

This blog post explains how Google's Project Zero created a custom fuzzing harness to identify vulnerabilities in macOS's CoreAudio system by targeting Mach IPC messages, using a "knowledge-driven fuzzing" approach that merges automation with reverse engineering. Through iterative enhancements to the harness, including proper system initialization, API call chaining for stateful operations, mocking out problematic functionality, and refining message structures, the author identified a type confusion vulnerability (CVE-2024-54529) in the CoreAudio daemon. This vulnerability arose because several message handlers did not verify object types before function calls, allowing arbitrary code execution via crafted Mach messages sent from a sandboxed process.