Talos Vulnerability Report


Pixar Renderman install helper privilege escalation vulnerability

January 14, 2019
CVE Number



A local privilege escalation vulnerability exists in the install helper tool of the Mac OS X version of Pixar Renderman, version 22.2.0. A user with local access can use this vulnerability to escalate their privileges to root. An attacker would need local access to the machine to successfully exploit this flaw.

Tested Versions

Renderman 22.2.0 for Mac OS X

Product URLs


CVSSv3 Score

9.0 - CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N


CWE-19: Improper Input Validation


Renderman is a rendering application used in animation and film production. It is widely used for advanced rendering and shading in many large-scale environments. When installing the Mac OS X version of the application, a helper tool is installed and launched as root. This service continues to listen even after completing installation. The vulnerability lies in the lack of verification in the Dispatch function. The caller of this function is not checked, and the function is exposed to any user. The relevant code is shown below.

case 0x101D3:                                                  [0]
      v11 = xpc_dictionary_create_reply(a1[1]);
      v12 = a1[1];
      v13 = xpc_dictionary_get_value();
      length = xpc_array_get_count(v13, "argv");               [1]
      if ( (signed int)length > 0 )

        //COPY LOOP 

        while ( argc < length );                                [2]

        v15 = Launch(argv, argc);                               [3]

The first part of the function, [0], gets the message ID and passes it through a switch statement. If the case is the one shown, this code block is entered. At location [1], the count of the XPC array argv is determined. There is an extensive copy loop, [2], that copies from the XPC array to an internal memory structure. This structure is then passed in to Launch at location [3]. This allows any application to pass in an XPC array named argv, and the application will launch a binary with the contents of said array. This helper runs as root so this crosses a privilege boundary, allowing an attacker to run code with elevated privileges.

Exploit Proof of Concept

Included with this advisory is a C source file, as well as a Python script. The Python script needs to be made executable and put into /tmp/root.py. The command nc -l 1337 needs to be executed in a separate window to accept the root shell.


2018-11-28 - Vendor disclosure
2018-12-11 - Vendor patched
2019-01-14 - Public release


Discovered by Tyler Bohan of Cisco Talos.