PT-2024-31009 · Apple · Apple Macos

Csaba Fitzl + 1 · Published 2024-09-16 · Updated 2025-07-30 · CVE-2024-44175

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions macOS versions prior to 14.7.1 macOS versions prior to 15

Description This issue is related to improved validation of symlinks. An app may be able to access sensitive user data due to a TOCTOU vulnerability in macOS's diskarbitrationd, enabling sandbox escape and privilege escalation attacks through the exploitation of symbolic links.

Recommendations For macOS versions prior to 14.7.1, update to macOS 14.7.1 or later. For macOS versions prior to 15, update to macOS 15 or later. As a temporary workaround, consider restricting the use of the os.symlink() function until a patch is available. Avoid using the os.symlink() function in sensitive areas of the system until the issue is resolved.

Fix

Insecure Storage of Sensitive Information

Link Following

Weakness Enumeration

CWE-922

CWE-59

Related Identifiers

CVE-2024-44175

Affected Products

Apple Macos

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2024-44175 · Security Note
• https://support.apple.com/en-us/121238 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-44175 · Vendor Advisory
• https://support.apple.com/en-us/121570 · Vendor Advisory
• https://twitter.com/ksg93rd/status/1950578489964286024 · Twitter Post
• https://twitter.com/binitamshah/status/1855183305722994815 · Twitter Post
• https://twitter.com/hackyboiz/status/1861724562800759040 · Twitter Post
• https://t.me/cybersecuritytechnologies/11500 · Telegram Post
• https://t.me/CyberSecurityTechnologies/12205 · Telegram Post
• https://twitter.com/theevilbit/status/1854908887071330389 · Twitter Post
• https://reddit.com/r/crowdstrike/comments/1hcr7uy/detecting_macos_symlink_creation_without_ln_s · Reddit Post
• https://twitter.com/UAFnUg/status/1862063140042936737 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-44175 · Note
• https://twitter.com/ksg93rd/status/1862917378239046040 · Twitter Post
• http://seclists.org/fulldisclosure/2024/Oct/12 · Note