Overview
Microsoft has identified a significant vulnerability (CVE-2024-44243) in Apple's macOS that enables attackers to bypass System Integrity Protection and install malicious kernel drivers. The flaw, rated with a CVSS score of 5.5, affects the Storage Kit daemon and could lead to successful patching through macOS Sequoia 15.2
Whom it may concern
- MacOS system administrators
- Security operations teams
- Enterprise risk managers
- Apple device fleet managers
Key Findings
- Vulnerability allows SIP bypass through storagekitd exploitation
- Patch available in macOS Sequoia 15.2 update
- Root-level access required for initial exploitation
- Potential for rootkit installation and persistent malware
Risk Analysis
- Probability: Medium (requires root access)
- Impact: High (system-wide compromise)
- Attack Surface:
- Disk Utility operations
- File system operations
- Protected system directories
Action Items
- Install macOS Sequoia 15.2 immediately
- Monitor system integrity checks
- Review third-party kernel extension policies
- Implement enhanced endpoint monitoring
Sources
- [The Hacker News](https://thehackernews.com/2025/01/microsoft-uncovers-macos-vulnerability.html)
