CVE-2024-23244
📋 TL;DR
This macOS privilege escalation vulnerability allows a standard user application to gain elevated privileges after an administrator user logs in. It affects macOS Monterey and Sonoma systems where standard users and administrators share the same device. The vulnerability stems from a logic issue in macOS security restrictions.
💻 Affected Systems
- macOS
📦 What is this software?
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →⚠️ Risk & Real-World Impact
Worst Case
A standard user could gain full administrative privileges, potentially compromising the entire system, accessing sensitive data, installing malware, or creating persistent backdoors.
Likely Case
A malicious standard user could escalate privileges to install unauthorized software, modify system settings, or access other users' data after an admin logs in.
If Mitigated
With proper user separation and least privilege principles, impact is limited to the compromised user account only.
🎯 Exploit Status
Exploitation requires a malicious application running under a standard user account and timing with administrator login. No public exploit code has been disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: macOS Monterey 12.7.4, macOS Sonoma 14.4
Vendor Advisory: https://support.apple.com/en-us/HT214083
Restart Required: Yes
Instructions:
1. Open System Settings > General > Software Update. 2. Install available updates. 3. Restart when prompted. For enterprise: Deploy updates via MDM or Apple Business/School Manager.
🔧 Temporary Workarounds
User Account Separation
allSeparate administrator and standard user functions to different physical devices or virtual machines
Disable Standard User Accounts
macOSConvert all user accounts to administrator accounts or use single-user mode (not recommended for security)
🧯 If You Can't Patch
- Implement strict application allowlisting to prevent unauthorized applications from running
- Enforce separation of duties - ensure administrators use separate devices from standard users
🔍 How to Verify
Check if Vulnerable:
Check macOS version: If running macOS Monterey earlier than 12.7.4 or macOS Sonoma earlier than 14.4, the system is vulnerable.Check Version:
sw_versVerify Fix Applied:
Verify macOS version is 12.7.4 or later for Monterey, or 14.4 or later for Sonoma.📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events in system.log
- Sudden admin privilege grants to standard user processes
- Unauthorized sudo or authorization events
Network Indicators:
- None - this is a local privilege escalation vulnerability
SIEM Query:
source="macOS" AND (event_type="privilege_escalation" OR event_type="authorization" OR process="sudo") AND user="standard_user"🔗 References
- http://seclists.org/fulldisclosure/2024/Mar/21
- http://seclists.org/fulldisclosure/2024/Mar/23
- https://support.apple.com/en-us/HT214083
- https://support.apple.com/en-us/HT214084
- http://seclists.org/fulldisclosure/2024/Mar/21
- http://seclists.org/fulldisclosure/2024/Mar/23
- https://support.apple.com/en-us/HT214083
- https://support.apple.com/en-us/HT214084
- https://support.apple.com/kb/HT214083
- https://support.apple.com/kb/HT214084
