Jan 14, 2025Ravie LakshmananEndpoint Security / Vulnerability

Microsoft has shed light on a now-patched security flaw impacting Apple macOS that, if successfully exploited, could have allowed an attacker running as “root” to bypass the operating system’s System Integrity Protection (SIP) and install malicious kernel drivers by loading third-party kernel extensions.

The vulnerability in question is CVE-2024-44243 (CVSS score: 5.5), a medium-severity bug that was addressed by Apple as part of macOS Sequoia 15.2 released last month. The iPhone maker described it as a “configuration issue” that could permit a malicious app to modify protected parts of the file system.

“Bypassing SIP could lead to serious consequences, such as increasing the potential for attackers and malware authors to successfully install rootkits, create persistent malware, bypass Transparency, Consent and Control (TCC), and expand the attack surface for additional techniques and exploits,” Jonathan Bar Or of the Microsoft Threat Intelligence team said.

SIP, also called rootless, is a security framework that aims to prevent malicious software installed on a Mac from tampering with the protected parts of the operating system, including /System, /usr, /bin, /sbin, /var, and the apps that come pre-installed on the device.

It works by enforcing various protections against the root user account, allowing modification of these protected parts only by processes that are signed by Apple and have special entitlements to write to system files, such as Apple software updates and Apple installers.

The two entitlements specific to SIP are below –

• com.apple.rootless.install, which lifts SIP’s file system restrictions for a process with this entitlement
• com.apple.rootless.install.heritable, which lifts SIP’s file system restrictions for a process and all its child processes by inheriting the com.apple.rootless.install entitlement

CVE-2024-44243, the latest SIP bypass discovered by Microsoft in macOS after CVE-2021-30892 (Shrootless) and CVE-2023-32369 (Migraine), exploits the Storage Kit daemon’s (storagekitd) “com.apple.rootless.install.heritable” entitlement to get around SIP protections.

Specifically, this is achieved by taking advantage of “storagekitd’s ability to invoke arbitrary processes without proper validation or dropping privileges” to deliver a new file system bundle to /Library/Filesystems – a child process of storagekitd – and override the binaries associated with the Disk Utility, which could then be triggered during certain operations such as disk repair.

“Since an attacker that can run as root can drop a new file system bundle to /Library/Filesystems, they can later trigger storagekitd to spawn custom binaries, hence bypassing SIP,” Bar Or said. “Triggering the erase operation on the newly created file system can bypass SIP protections as well.”

The disclosure comes nearly three months after Microsoft also detailed another security flaw in Apple’s Transparency, Consent, and Control (TCC) framework in macOS (CVE-2024-44133, CVSS score: 5.5) – aka HM Surf – that could be exploited to access sensitive data.

“Prohibiting third-party code to run in the kernel can increase macOS reliability, the tradeoff being that it reduces monitoring capabilities for security solutions,” Bar Or said.

“If SIP is bypassed, the entire operating system can no longer be considered reliable, and with reduced monitoring visibility, threat actors can tamper with any security solutions on the device to evade detection.”