CVE-2024-54489
📋 TL;DR
A path handling vulnerability in macOS mount command allows arbitrary code execution when processing malicious input. This affects macOS systems before the patched versions, potentially enabling attackers to gain unauthorized access or control.
💻 Affected Systems
- macOS
📦 What is this software?
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root privileges, allowing complete control over the affected macOS system, data theft, and lateral movement within the network.
Likely Case
Local privilege escalation from a standard user to root, enabling installation of persistent malware, data access, and system modification.
If Mitigated
Limited impact with proper patch management and restricted user access, though unpatched systems remain vulnerable to local attackers.
🎯 Exploit Status
Exploitation requires local user access; public disclosure suggests exploit code may be available or easily developed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2
Vendor Advisory: https://support.apple.com/en-us/121839
Restart Required: Yes
Instructions:
1. Open System Settings > General > Software Update. 2. Install available updates. 3. Restart the system when prompted.
🔧 Temporary Workarounds
Restrict mount command usage
allLimit execution of mount command to privileged users only via sudoers configuration.
sudo visudo
Add line: 'ALL ALL=(ALL) !/sbin/mount' to restrict mount command
🧯 If You Can't Patch
- Implement strict least privilege access controls to limit who can execute mount commands.
- Monitor for unusual mount command usage or privilege escalation attempts via security logging.
🔍 How to Verify
Check if Vulnerable:
Check macOS version: if running macOS Sequoia <15.2, Ventura <13.7.2, or Sonoma <14.7.2, system is vulnerable.Check Version:
sw_versVerify Fix Applied:
Verify macOS version is at or above patched versions: Sequoia 15.2, Ventura 13.7.2, or Sonoma 14.7.2.📡 Detection & Monitoring
Log Indicators:
- Unusual mount command executions, especially with unexpected paths or arguments
- Privilege escalation attempts via mount
Network Indicators:
- None - this is a local exploitation vulnerability
SIEM Query:
source="macos_system_logs" AND (process="mount" AND args CONTAINS suspicious_pattern)