Recent macOS Vulnerability Allows Bypass of System Integrity Protection
On January 13, 2025, Apple addressed a critical macOS vulnerability identified as CVE-2024-44243. This flaw allowed attackers with root privileges to bypass System Integrity Protection (SIP) and install malicious kernel drivers, posing significant security risks to macOS users.
Understanding System Integrity Protection (SIP)
System Integrity Protection, introduced by Apple in macOS El Capitan, is a security feature designed to restrict the root user from performing operations that may compromise system integrity. SIP limits the actions that the root account can perform on protected parts of the system, ensuring that malicious software cannot modify critical system files and directories.
Details of the Vulnerability
The vulnerability resided in the Storage Kit daemon responsible for disk state-keeping. Exploiting this flaw, attackers could bypass SIP restrictions without requiring physical access to the device. This capability enabled the installation of rootkits (malicious kernel drivers), creation of persistent malware, and circumvention of Transparency, Consent, and Control (TCC) security checks, granting unauthorized access to users' private data.
Microsoft's Findings
Microsoft's security research team discovered this vulnerability and reported it to Apple. They noted that bypassing SIP undermines the entire operating system's security, potentially leading to severe consequences. The ability to load third-party kernel extensions without proper authorization could allow attackers to execute arbitrary code with elevated privileges, making the system vulnerable to various threats.
Apple's Response
In response to the report, Apple released security updates for macOS Sequoia 15.2 on December 11, 2024, patching the vulnerability. Users are strongly advised to update their systems to the latest version to protect against potential exploits targeting this flaw.
Previous SIP Bypass Vulnerabilities
This is not the first instance of SIP bypass vulnerabilities in macOS. In 2021, Microsoft reported a similar issue dubbed 'Shrootless' (CVE-2021-30892), which allowed attackers to perform arbitrary operations on compromised Macs and potentially install rootkits. Another vulnerability, 'Migraine' (CVE-2023-32369), was reported in 2023, enabling attackers with root access to bypass SIP and perform unauthorized operations on the device.
Conclusion
The discovery of this vulnerability underscores the importance of maintaining up-to-date security measures and the need for continuous monitoring of system processes. Users should ensure their macOS devices are updated regularly and remain vigilant against potential security threats.