CVE-2020-9847
📋 TL;DR
CVE-2020-9847 is an out-of-bounds read vulnerability in macOS that allows malicious applications to potentially escape their sandbox restrictions. This affects macOS systems prior to Catalina 10.15.5. Attackers could leverage this to gain unauthorized access to system resources.
💻 Affected Systems
- macOS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
A malicious application could fully escape the macOS sandbox, gaining unauthorized access to sensitive system files, user data, and potentially executing arbitrary code with elevated privileges.
Likely Case
Malicious applications could bypass sandbox restrictions to access restricted files or system resources they shouldn't have access to, potentially leading to data theft or further system compromise.
If Mitigated
With proper application vetting and security controls, the risk is limited to untrusted applications that manage to bypass macOS Gatekeeper protections.
🎯 Exploit Status
Exploitation requires a malicious application to be installed and executed on the target system. No public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: macOS Catalina 10.15.5 or later
Vendor Advisory: https://support.apple.com/HT211170
Restart Required: Yes
Instructions:
1. Open System Preferences > Software Update. 2. Install macOS Catalina 10.15.5 update. 3. Restart the system when prompted.
🔧 Temporary Workarounds
Restrict Application Installation
allConfigure macOS Gatekeeper to only allow apps from the App Store and identified developers
sudo spctl --master-enable
sudo spctl --enable
Disable Automatic App Opening
allPrevent automatically opening apps from unidentified developers
defaults write com.apple.LaunchServices LSQuarantine -bool true
🧯 If You Can't Patch
- Implement strict application control policies to prevent installation of untrusted applications
- Use endpoint detection and response (EDR) solutions to monitor for sandbox escape attempts
🔍 How to Verify
Check if Vulnerable:
Check macOS version: if running macOS Catalina earlier than 10.15.5, system is vulnerableCheck Version:
sw_versVerify Fix Applied:
Verify macOS version is 10.15.5 or later using 'sw_vers' command📡 Detection & Monitoring
Log Indicators:
- Unusual sandbox violation logs in system.log
- Applications attempting to access restricted system paths
Network Indicators:
- None - local exploitation only
SIEM Query:
source="system.log" AND "sandbox" AND "violation" AND process="kernel"