CVE-2025-30444
📋 TL;DR
A race condition vulnerability in macOS SMB client allows attackers to cause system termination (kernel panic) by mounting a malicious SMB share. This affects macOS Ventura, Sequoia, and Sonoma before specific patch versions. The vulnerability requires network access to an SMB server controlled by an attacker.
💻 Affected Systems
- macOS
📦 What is this software?
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →⚠️ Risk & Real-World Impact
Worst Case
Complete system crash (kernel panic) leading to denial of service, potential data loss from unsaved work, and disruption of business operations.
Likely Case
System crash requiring reboot, causing temporary unavailability of affected Mac systems.
If Mitigated
No impact if systems are patched or SMB client access is restricted to trusted networks.
🎯 Exploit Status
Exploit requires victim to mount attacker-controlled SMB share. Public disclosures suggest proof-of-concept exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5
Vendor Advisory: https://support.apple.com/en-us/122373
Restart Required: Yes
Instructions:
1. Open System Settings > General > Software Update. 2. Install available updates. 3. Restart when prompted.
🔧 Temporary Workarounds
Disable SMB client
allPrevent macOS from mounting SMB shares to eliminate attack vector
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.smbd.plist
Restrict SMB network access
allUse firewall rules to block SMB connections to untrusted networks
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add /usr/sbin/smbd
🧯 If You Can't Patch
- Segment network to restrict SMB traffic to trusted zones only
- Implement network monitoring for SMB connection attempts to unknown servers
🔍 How to Verify
Check if Vulnerable:
Check macOS version in System Settings > General > About. If version is below patched versions, system is vulnerable.Check Version:
sw_versVerify Fix Applied:
Verify macOS version matches or exceeds: Ventura 13.7.5, Sequoia 15.4, or Sonoma 14.7.5📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs in Console.app
- SMB connection failures to unknown IPs
- Unexpected system reboots
Network Indicators:
- SMB connections to external/untrusted IP addresses
- SMB traffic patterns matching share mounting
SIEM Query:
source="macos_system_logs" AND (event="kernel panic" OR process="smbd")