PT-2019-19117 · Apple · Apple Macos

Phoenhex + 1 · Published 2019-05-30 · Updated 2019-12-23 · CVE-2019-8606

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apple macOS versions prior to 10.14.5

Description A validation issue existed in the handling of symlinks, which has been addressed with improved validation. This could have allowed a local user to load unsigned kernel extensions, potentially leading to privilege escalation.

Recommendations For versions prior to 10.14.5, update to macOS Mojave 10.14.5 to resolve the issue.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2019-8606

ZDI-19-541

Affected Products

Apple Macos

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-8606 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-541 · Security Note
• https://support.apple.com/HT210119 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-8606 · Vendor Advisory