A new vulnerability has been discovered in macOS that allows attackers with root access to bypass System Integrity Protection (SIP) and take arbitrary actions on affected devices.
Discovered by Microsoft and named “Migrene,” the flaw was disclosed to Apple through a coordinated vulnerability disclosure (CVD) via Microsoft Security Vulnerability Research (MSVR).
SIP is a security technology implemented in macOS that prevents root users from compromising system integrity. SIP, also known as “routeless”, was introduced in macOS Yosemite by Apple as a security measure. This limits the root user’s access to sensitive system files and directories.
Technically speaking, SIP cannot be disabled on a running system and instead requires physical access to the device via the recovery OS. SIP bypass allows an attacker to override her SIP-protected directories and files.
Bypassing SIP can therefore lead to the installation of rootkits, the creation of persistent malware, and an increased attack surface for further exploitation.
Microsoft explained that the techniques used to exploit this vulnerability are similar to those found in the Shrootless vulnerability (tracked CVE-2021-30892) published in 2021.
“We focused on system processes signed by Apple and with the com.apple.rootless.install.heritable entitlement that could be tampered with to execute arbitrary code in a security context that bypasses SIP checks. Found 2 child processes.” Read Microsoft’s advisory published on Tuesday.
The tech giant has confirmed that Apple released a security update on May 18, 2023 to address an issue identified as CVE-2023-32369.
In a security bulletin, Apple said “a logical problem was solved with improved state management,” and credited Microsoft researchers Jonathan Bar Or, Anurag Bohra, and Michael Pearse for the findings. .
Read more about Apple’s vulnerabilities: Apple patches two zero-days in the wild
According to Microsoft, the discovery of the migraine vulnerability highlights the importance of continued research and collaboration to mitigate security risks across the platform.
In adjacent news, Microsoft, Apple and Google recently partnered on a passwordless standard.
Editorial image credit: WeDesing / Shutterstock.com
