# Finding 4: World-Writable Virtio Serial Port on macOS (HIGH) **CWE-732 (Incorrect Permission Assignment for Critical Resource)** **Affected:** macOS builds (Linux virtio port is properly `0600 root:root`)
## Root Cause On macOS, the SPICE virtio serial port device is created with world-readable and world-writable permissions: ``` $ ls -la /dev/tty.com.redhat.spice.0 crw-rw-rw- 1 root wheel 0x9000000 25 Apr 09:04 /dev/tty.com.redhat.spice.0 ``` This is the raw SPICE protocol channel between the host hypervisor and the guest. The daemon (`spice-vdagentd`) uses this device to communicate with the SPICE host for clipboard sharing, file transfers, and monitor configuration. With `crw-rw-rw-` permissions, any unprivileged process on the guest can open this device and directly interact with the SPICE wire protocol, completely bypassing the daemon. ## Impact Any unprivileged user can: 1. **Open the device RDWR** — read and write raw SPICE protocol messages 2. **Acquire TIOCEXCL exclusive lock** — locks the root daemon OUT of the virtio channel entirely, giving the attacker sole control 3. **Intercept all host→guest SPICE traffic** (clipboard, file transfers, capabilities) 4. **Inject arbitrary guest→host SPICE protocol frames** This is independent of the UDSCS authentication bypass (Finding 1). Even if the daemon socket were properly authenticated, the virtio device gives direct access to the underlying SPICE wire protocol. ## Proof of Concept ``` $ id uid=502(attacker) gid=20(staff) $ ./spice_lpe_exploit [Stage 2] Checking SPICE virtio serial port... crw-rw-rw- 1 root wheel /dev/tty.com.redhat.spice.0 [+] WORLD WRITABLE — any user can read/write raw SPICE protocol! [+] Opened RDWR (fd=3) [+] EXCLUSIVE LOCK acquired — daemon locked out of virtio port! [+] Intercepted 40 bytes: ANNOUNCE_CAPABILITIES from SPICE host [+] Intercepted 32 bytes: CLIPBOARD_GRAB from SPICE host [+] Injected clipboard "PWNED_BY_DORKERDEVIL" to host ``` ## Linux Comparison On Linux, the virtio port is properly restricted: ``` $ ls -la /dev/virtio-ports/com.redhat.spice.0 crw------- 1 root root 245, 0 May 3 17:50 /dev/virtio-ports/com.redhat.spice.0 ``` ## Suggested Fix Set device permissions to `crw-rw----` (`root:wheel`): ``` chmod 0660 /dev/tty.com.redhat.spice.0 ``` Or configure device creation (IOKit/kext) to use `0600` permissions matching the Linux default. ## Author Ashish Kunwar (@D0rkerDevil) — [email protected]
