Login Sign Up

CVE-2024-44141

6.8 MEDIUM

📋 TL;DR

This vulnerability allows an attacker with physical access to an unlocked Mac to execute arbitrary code with root privileges. It affects macOS systems before Sonoma 14.6. The risk is primarily to organizations with shared or publicly accessible Mac computers.

💻 Affected Systems

Products:
  • macOS
Versions: Versions before macOS Sonoma 14.6
Operating Systems: macOS
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects systems where an attacker can physically access an unlocked Mac. Locked or powered-off systems are not vulnerable.

📦 What is this software?

Macos by Apple

macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...

Learn more about Macos →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise with root-level persistence, data theft, and installation of backdoors or malware.

🟠

Likely Case

Local privilege escalation leading to unauthorized access to sensitive files and system configuration changes.

🟢

If Mitigated

Limited impact if physical access controls prevent unauthorized users from accessing unlocked systems.

🌐 Internet-Facing: LOW - Requires physical access, not remotely exploitable.
🏢 Internal Only: MEDIUM - Insider threats or unauthorized physical access could exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: LOW

Exploitation requires physical access to an unlocked system, making it straightforward for an attacker with that access.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: macOS Sonoma 14.6

Vendor Advisory: https://support.apple.com/en-us/120911

Restart Required: Yes

Instructions:

1. Open System Settings. 2. Go to General > Software Update. 3. Install macOS Sonoma 14.6 update. 4. Restart the computer when prompted.

🔧 Temporary Workarounds

Enable automatic screen lock

all

Configure macOS to lock automatically after inactivity to prevent physical access to unlocked systems.

sudo defaults write /Library/Preferences/com.apple.screensaver askForPassword -int 1
sudo defaults write /Library/Preferences/com.apple.screensaver askForPasswordDelay -int 0

Require password immediately after sleep or screen saver

all

Set immediate password requirement when waking from sleep or screen saver.

sudo defaults write /Library/Preferences/com.apple.screensaver askForPasswordDelay -int 0

🧯 If You Can't Patch

  • Implement strict physical access controls to prevent unauthorized users from accessing Mac computers.
  • Enforce policies requiring users to lock screens when away from their workstations.

🔍 How to Verify

Check if Vulnerable:

Check macOS version: if running macOS Sonoma earlier than 14.6, the system is vulnerable.

Check Version:

sw_vers

Verify Fix Applied:

Verify macOS version is 14.6 or later after applying the update.

📡 Detection & Monitoring

Log Indicators:

  • Unexpected root privilege escalations in system logs
  • Unauthorized user account activity

Network Indicators:

  • Unusual outbound connections from affected systems

SIEM Query:

source="macos_system_logs" AND (event="privilege_escalation" OR user="root")

📊 Metadata

CVE ID: CVE-2024-44141
CVSS v3 Score: 6.8 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: October 24, 2024
Last Updated: December 11, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON