CVE-2024-54463
📋 TL;DR
This macOS vulnerability allows malicious applications to access removable storage devices (like USB drives) without user permission. It affects macOS systems before Sequoia 15, potentially exposing sensitive data on connected external media.
💻 Affected Systems
- macOS
📦 What is this software?
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →⚠️ Risk & Real-World Impact
Worst Case
Malicious app could exfiltrate sensitive data from connected USB drives, external hard drives, or other removable media without user knowledge or consent.
Likely Case
Malware or compromised applications could access and steal data from connected removable storage devices.
If Mitigated
With proper app vetting and security controls, risk is limited to untrusted applications gaining unauthorized data access.
🎯 Exploit Status
Exploitation requires user to install and run malicious application. No authentication bypass needed beyond app execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: macOS Sequoia 15
Vendor Advisory: https://support.apple.com/en-us/121238
Restart Required: Yes
Instructions:
1. Open System Settings 2. Click General 3. Click Software Update 4. Install macOS Sequoia 15 update 5. Restart when prompted
🔧 Temporary Workarounds
Restrict App Installation
allOnly install applications from trusted sources like the Mac App Store or identified developers.
Disconnect Unused Removable Media
allPhysically disconnect USB drives and other removable media when not in use.
🧯 If You Can't Patch
- Implement application allowlisting to prevent untrusted applications from running
- Use endpoint protection software that monitors for suspicious file access patterns
🔍 How to Verify
Check if Vulnerable:
Check macOS version: If version is earlier than 15.0, system is vulnerable.Check Version:
sw_versVerify Fix Applied:
Verify macOS version is 15.0 or later after update.📡 Detection & Monitoring
Log Indicators:
- Unusual volume mount events from non-system applications
- File access patterns from applications to removable media
Network Indicators:
- Unexpected outbound data transfers following removable media access
SIEM Query:
process_name:* AND event_type:file_access AND target_path:/Volumes/*