CVE-2020-29622
📋 TL;DR
A race condition vulnerability in macOS Catalina's NFS client allows attackers to execute arbitrary code with system privileges by mounting a malicious NFS share. This affects macOS Catalina systems before Security Update 2021-005. Attackers could gain full control of affected systems.
💻 Affected Systems
- macOS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root privileges, allowing installation of persistent malware, data theft, and lateral movement.
Likely Case
Local privilege escalation or remote code execution if users mount untrusted NFS shares.
If Mitigated
Limited impact if NFS mounting is restricted and systems are isolated from untrusted networks.
🎯 Exploit Status
Requires ability to serve malicious NFS share and convince user/system to mount it. Race conditions can be challenging to exploit reliably.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Security Update 2021-005 for macOS Catalina
Vendor Advisory: https://support.apple.com/en-us/HT212805
Restart Required: Yes
Instructions:
1. Open System Preferences > Software Update. 2. Install Security Update 2021-005. 3. Restart the system when prompted.
🔧 Temporary Workarounds
Disable NFS client
allPrevent NFS mounting by disabling the NFS client service
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.nfsd.plist
Restrict NFS mounting
allOnly allow NFS mounting from trusted sources using firewall rules
sudo pfctl -f /etc/pf.conf
🧯 If You Can't Patch
- Disable NFS client functionality entirely
- Implement network segmentation to isolate systems from untrusted NFS servers
🔍 How to Verify
Check if Vulnerable:
Check macOS version: System Preferences > About This Mac. If version is Catalina and Security Update 2021-005 is not installed, system is vulnerable.Check Version:
sw_versVerify Fix Applied:
Verify Security Update 2021-005 is installed in System Preferences > Software Update > Installed Updates.📡 Detection & Monitoring
Log Indicators:
- Unexpected NFS mount attempts in system logs
- Processes running with unexpected privileges after NFS mount
Network Indicators:
- NFS traffic to/from untrusted sources
- Unexpected NFS protocol activity
SIEM Query:
source="system.log" AND "nfs" AND ("mount" OR "connection")