CVE-2024-40804
📋 TL;DR
This CVE describes an information disclosure vulnerability in macOS where a malicious application could access private information. The vulnerability affects macOS systems before Sonoma 14.6. Apple has addressed this with improved checks in the latest update.
💻 Affected Systems
- macOS
📦 What is this software?
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →⚠️ Risk & Real-World Impact
Worst Case
A malicious application could access sensitive user data, credentials, or other private information stored on the system.
Likely Case
Malicious applications could access limited private information, potentially leading to data exposure or privacy violations.
If Mitigated
With proper application sandboxing and security controls, the impact would be limited to information accessible within the application's permissions.
🎯 Exploit Status
Exploitation requires a malicious application to be installed and executed on the target system. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: macOS Sonoma 14.6
Vendor Advisory: https://support.apple.com/en-us/HT214119
Restart Required: Yes
Instructions:
1. Open System Settings 2. Click General 3. Click Software Update 4. Install macOS Sonoma 14.6 update 5. Restart when prompted
🔧 Temporary Workarounds
Application Restriction
allRestrict installation of untrusted applications using Gatekeeper and only install applications from trusted sources
sudo spctl --master-enable
sudo spctl --enable
🧯 If You Can't Patch
- Implement strict application control policies to prevent installation of untrusted applications
- Use endpoint detection and response (EDR) solutions to monitor for suspicious application behavior
🔍 How to Verify
Check if Vulnerable:
Check macOS version: if running macOS Sonoma earlier than 14.6, the system is vulnerableCheck Version:
sw_versVerify Fix Applied:
Verify macOS version is 14.6 or later after applying the update📡 Detection & Monitoring
Log Indicators:
- Unusual application behavior accessing private data stores
- Installation of untrusted applications
Network Indicators:
- No network indicators as this is a local vulnerability
SIEM Query:
macOS application execution events from untrusted sources or unusual data access patterns