Skip to content
operating-system

CVE-2023-42860

Description

CVE-2023-42860 is a permissions issue within Apple's PackageKit framework that could allow an application to modify protected parts of the file system. The vulnerability was addressed by Apple through additional restrictions in macOS Monterey 12.7.1, macOS Ventura 13.6.1, and macOS Sonoma 14.1. According to Kandji's analysis, this vulnerability allowed an attacker to swap the installer package after the system verified its code signature. The system would then install the supplied package instead of the original, enabling the attacker to bypass System Integrity Protection (SIP).

Impact

Exploitation of this vulnerability could lead to unauthorized modification of protected file system areas by an application. The severity of this issue has been assessed as follows:

How Apple Mitigates Vulnerabilities in Installer Scripts

The scripts that macOS uses to install new apps have known vulnerabilities. Fortunately, Apple has come up with a clever solution to mitigate them.

Stay up to date

Iru's bi-weekly collection of articles, videos, and research to keep IT & Security teams ahead of the curve.