PT-2022-6992 · Apple · Apple Macos

Patch1T · Published 2022-05-16 · Updated 2025-02-05 · CVE-2022-26712

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions macOS versions prior to 11.6.6 macOS versions prior to 12.4

Description The issue is related to the PackageKit component in macOS, which has insufficient access controls. Exploitation of this issue may allow an attacker to execute arbitrary code. A malicious application may be able to modify protected parts of the file system. The estimated number of potentially affected devices is not specified. There have been reports of real-world incidents where this issue was exploited, including the use of a Fully Undetectable (FUD) macOS Backdoor.

Recommendations For macOS versions prior to 11.6.6, update to version 11.6.6 or later to resolve the issue. For macOS versions prior to 12.4, update to version 12.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable PackageKit component until a patch is available. Avoid using the DYLD INSERT LIBRARIES environment variable to load the ShoveService.framework, as it may be used to exploit this issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2023-06239

CVE-2022-26712

Affected Products

Apple Macos

References · 23

• https://nvd.nist.gov/vuln/detail/CVE-2022-26712 · Security Note
• https://bdu.fstec.ru/vul/2023-06239 · Security Note
• https://support.apple.com/en-us/HT213256 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26712 · Vendor Advisory
• https://support.apple.com/en-us/HT213257 · Vendor Advisory
• https://github.com/scarvell/advisories · Note
• https://twitter.com/byt3n33dl3/status/1880488927863468049 · Twitter Post
• https://twitter.com/rst_cloud/status/1887163723472588928 · Twitter Post
• https://twitter.com/moonlock_lab/status/1882441787710865590 · Twitter Post
• https://t.me/cybersecuritytechnologies/6501 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26712 · Note
• https://support.apple.com/en-us/102873 · Note
• https://t.me/thebugbountyhunter/6395 · Telegram Post
• https://t.me/poxek/2162 · Telegram Post
• https://t.me/pentestingnews/26343 · Telegram Post