PT-2023-8356 · Apple · Apple Macos

Jewel Lambert · Published 2023-10-25 · Updated 2024-07-17 · CVE-2023-41989

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions macOS versions prior to 14.1

Description The issue is related to errors in security settings of the Emoji component in the macOS operating system. An attacker may be able to execute arbitrary code as root from the Lock Screen. This is achieved by exploiting the vulnerability in the options offered on a locked device.

Recommendations For versions prior to 14.1, update to macOS Sonoma 14.1 to resolve the issue. As a temporary workaround, consider restricting options offered on a locked device to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2024-00545

CVE-2023-41989

Affected Products

Apple Macos

References · 11

• https://bdu.fstec.ru/vul/2024-00545 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41989 · Vendor Advisory
• https://support.apple.com/kb/HT213984 · Vendor Advisory
• https://support.apple.com/en-us/HT213984 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41989 · Security Note
• https://support.apple.com/kb/HT214037 · Note
• http://seclists.org/fulldisclosure/2023/Oct/24 · Note
• https://t.me/cvenotify/86449 · Telegram Post
• https://t.me/cvenotify/59970 · Telegram Post
• https://twitter.com/patrickwardle/status/1717496733423354051 · Twitter Post
• https://support.apple.com/kb/HT214038 · Note