{"id":25673,"date":"2025-01-14T05:01:22","date_gmt":"2025-01-14T13:01:22","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2025\/01\/14\/news-19396\/"},"modified":"2025-01-14T05:01:22","modified_gmt":"2025-01-14T13:01:22","slug":"news-19396","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2025\/01\/14\/news-19396\/","title":{"rendered":"Analyzing CVE-2024-44243, a macOS System Integrity Protection bypass through kernel extensions"},"content":{"rendered":"

Credit to Author: Microsoft Threat Intelligence| Date: Mon, 13 Jan 2025 17:00:00 +0000<\/strong><\/p>\n

Microsoft Threat Intelligence discovered a new macOS vulnerability that could allow attackers to bypass Apple\u2019s System Integrity Protection<\/a> (SIP) in macOS by loading third party kernel extensions. SIP is a security technology that restricts the performance of operations that may compromise system integrity; thus, a SIP bypass affects the overall security of the operating system. Bypassing SIP could lead to serious consequences, such as increasing the potential for attackers and malware authors to successfully install rootkits, create persistent malware, bypass Transparency, Consent and Control (TCC), and expand the attack surface for additional techniques and exploits.<\/p>\n

We shared these findings with Apple through Coordinated Vulnerability Disclosure<\/a> (CVD) via Microsoft Security Vulnerability Research<\/a> (MSVR). A fix for this vulnerability, now identified as CVE-2024-44243<\/a>, was included in the security updates<\/a> released by Apple on December 11, 2024. The findings were discovered in parallel between Microsoft and Mickey Jin<\/a>, who also responsibly reported the vulnerability to Apple. Users should ensure their systems are up to date. We thank the Apple security team for their collaboration and efforts in fixing this issue.<\/p>\n

In many cases, special entitlements are leveraged to bypass security mechanisms like SIP, making it essential to monitor specially entitled processes for anomalous behavior. This need for proactive monitoring is only further emphasized when a specially entitled process invokes kernel extensions from third party organizations without proper validation or reduced privileges, which an attacker could exploit to install a kernel driver (rootkit) in a way that could evade detection by security solutions. Following our previous SIP bypass blog posts (Shrootless<\/a>, Migraine<\/a>), our team set up mechanisms to proactively alert on potentially attacker-controlled child processes of special entitled processes, which enabled Microsoft Defender and our researcher team to ultimately identify CVE-2024-44243.<\/p>\n

In this blog post, we detail the connection between entitlements and SIP and explain how CVE-2024-44243 could be used to bypass SIP security measures. This research also highlights some of the benefits and challenges of kernel-based monitoring. Prohibiting third party code to run in the kernel can increase macOS reliability, the tradeoff being that it reduces monitoring capabilities for security solutions. If SIP is bypassed, the entire operating system can no longer be considered reliable, and with reduced monitoring visibility, threat actors can tamper with any security solutions on the device to evade detection. As such, this research is being presented to the broader security community to underline the critical role of responsible disclosure and collaborative efforts in securing devices across platforms.<\/p>\n

Understanding SIP and entitled processes<\/h2>\n

As previously covered in our previous SIP bypass blogposts (Shrootless<\/a>, Migraine<\/a>), SIP (also known as \u201crootless\u201d) is a macOS mechanism that enforces several operating system protections against the root user, including the ability to:<\/p>\n