# lateralus (CVE-2023-32407) - a macOS TCC bypass

Metal's MTL_DUMP_PIPELINES_TO_JSON_FILE env var allowed arbitrary file write via a rename() race, bypassing TCC to overwrite TCC.db.

- Payout: $30,500
- Severity: high
- Program: Apple
- Credited: Gergely Kalman
- Disclosed: 2023-11-14
- CVE: CVE-2023-32407
- Write-up quality: 9/10
- Original: https://gergelykalman.com/lateralus-CVE-2023-32407-a-macos-tcc-bypass.html
- Library page: https://bugbountylibrary.com/r/blog%3Agergelykalman-com-lateralus-cve-2023-32407-a-macos-tcc-bypass-html
- Tags: domain:desktop impact:integrity impact:privesc kind:bounty platform:blog sev:high technique:race-window technique:source-review vuln:access-control vuln:race-condition

**Target:** macOS Metal framework / NSFileManager createFileAtPath
**Root cause:** Metal framework uses NSFileManager createFileAtPath() to write debug data to a path from an environment variable, which internally does a temp file write followed by rename(), and rename() resolves old and new paths separately, allowing a race to redirect the destination.
**Steps:**
1. Create symlink /Users/hacker/ourlink -> /Users/hacker/Library/Application Support/com.apple.TCC/
2. Create directory /Users/hacker/tmp/
3. Set MTL_DUMP_PIPELINES_TO_JSON_FILE=/Users/hacker/tmp/TCC.db
4. Run Music with this env var
5. Catch open() of /Users/hacker/tmp/.dat.nosyncXXXX.XXXXXX and open it for writing, hold fd
6. Atomically swap /Users/hacker/tmp with /Users/hacker/ourlink using renamex_np(RENAME_SWAP) in a loop
7. Wait and check if TCC.db was overwritten; retry if not
**How found:** Used an automation framework to run all FDA-entitled apps under dtrace, grepped for getenv and file-related strings, found MTL_DUMP_PIPELINES_TO_JSON_FILE in Metal, then analyzed the file write behavior with fs_usage and discovered the temp file + rename() pattern.
**Exploitation:** Attacker controls the environment variable to set the destination path, wins race #1 to catch the temp file and control its contents, then wins race #2 to swap the directory between rename() lookups, redirecting the rename to overwrite TCC.db with attacker-controlled content, achieving TCC bypass.
**Insight:** When auditing privileged apps, look for environment variables that control file paths and trigger file writes; trace syscalls to spot temp-file-then-rename patterns, which are racy if the path contains a subdirectory that can be swapped with a symlink.