Skip to content
operating-system

CVE-2024-44175

Description

CVE-2024-44175 is a vulnerability in Apple's macOS that could allow an application to access sensitive user data. The issue was addressed by Apple through improved validation of symlinks in macOS Sonoma 14.7.1 and macOS Sequoia 15. According to Kandji's analysis, this vulnerability involves a Time-of-Check to Time-of-Use (TOCTOU) race condition in the `diskarbitrationd` daemon. By exploiting this flaw, an attacker could escape the application sandbox and escalate privileges to root from a low-privileged user.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive user data by an application. The severity of this issue has been assessed as follows:

diskarbitrationd and storagekitd Audit Story Part 1

Uncovering Apple Vulnerabilities: The diskarbitrationd and storagekitd Audit Story Part 1

Kandji's Threat Research team performed an audit on the macOS diskarbitrationd & storagekitd system daemons, uncovering several (now fixed) vulnerabilities.

Stay up to date

Iru's bi-weekly collection of articles, videos, and research to keep IT & Security teams ahead of the curve.