Beyond Prompt Injection: Hacking Apple's Private Cloud Compute

What it is

CVE-2026-20685: a Zip Slip / CWE-22 path traversal in darwin-init, the root PID 1 provisioner for Apple Private Cloud Compute nodes. Found by Drinor Selmanaj (Sentry/SARC) inside Apple's Virtual Research Environment. CVSS 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), fixed in PCC 5E290.3+, $150,000 bounty. A more detailed technical paper is promised "in the coming weeks."

How it works

darwin-init reads only the first four bytes of a downloaded artifact to pick an extractor. A tar's ustar magic sits at offset 257, so a tar matches nothing and falls through to a generic extract(to:). That function appends the archive entry name to the output dir with no sanitation, and sets only ARCHIVE_EXTRACT_TIME|PERM|ACL|FFLAGS — none of libarchive's security flags — so entries write wherever they point and return ARCHIVE_OK. Two would-be controls fail: PrivateCloudOSValidator.validate(cryptexConfig:) is an empty function body in published source, and the per-cryptex sha256 digest is optional (attacker supplies the config, omits it).

Extraction base is /var/tmp/darwin-init/cryptex/<UUID>/ (four levels deep). Three .. reach /var/tmp (wiped by userspace reboot); four reach /var/db, which persists. The malicious tar must be both a traversal exploit and a valid cryptex, else the fullyApplied check fails and boot hangs. So it carries traversal entries (../../../../db/...) plus a genuine Restore/BuildManifest.plist and cryptex bundle built with Apple's own pccvre cryptex create.

Impact escalation: one traversal entry writes /var/db/prcos/splunkloggingd/config-main.plist, whose existence trips a PathState KeepAlive that starts splunkloggingd pointed at the attacker's Server. Redirected telemetry leaked CloudBoard state plus per-request bundleID/workloadType/requestID/automatedDeviceGroup, TIE token counts, and per-token timing (speculative-decoding side channel).

flowchart TD
    A[tar artifact] --> B{first 4 bytes<br/>match magic?}
    B -->|yes .aar| C[safe AA01 extractor]
    B -->|no| D[generic extract to:<br/>no security flags]
    D --> E["../../../../db/ writes<br/>as root, survive reboot"]
    E --> F[splunkloggingd config →<br/>attacker endpoint]
    F --> G[exfil inference telemetry]
    E -.-> H[attestation measures<br/>installed software only]

The attestation gap

A nonce-controlled diff of clean vs. poisoned boots (byte-identical .cxbd bundles) showed pccvre attestation verify treated both identically at every level. Attestation measures installed software, not writable-volume config files — so a poisoned node is indistinguishable from a clean one. This is the detection-relevant finding: runtime config on /var/db is outside the attested surface.

Caveats

Verified only in the VRE (PCC release 37684 / 5E290.3-era), not production; the research-only Debug Shell used for proof is absent in production. Rated information disclosure — no integrity/availability impact claimed.