A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to break out of its sandbox.
The vulnerability results from a synchronization error (race condition, CWE-362), which can be exploited by a malicious application running on the system. An application, racing to access a resource at a critical moment, can bypass the isolation mechanisms imposed by the macOS sandbox. Apple resolved the issue by applying additional validation at the vulnerable code location.
An attacker controlling a malicious application can trigger a sandbox escape, thereby gaining access to system resources and data beyond the permissions originally granted to the application.
The system should be updated to: macOS Sequoia 15.6, macOS Sonoma 14.7.7, or macOS Ventura 13.7.7, in accordance with security updates published by Apple at: https://support.apple.com/en-us/124149, https://support.apple.com/en-us/124150, https://support.apple.com/en-us/124151
macOS Sequoia versions before 15.6, macOS Sonoma versions before 14.7.7, macOS Ventura versions before 13.7.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HApple macOS
OSApple< 13.7.714.0 – 14.7.7 (bez)15.0 – 15.6 (bez)
Related vulnerabilities
Type confusion w V8 (Google Chrome) — zdalne uszkodzenie sterty
Apple iOS/iPadOS/macOS — out-of-bounds write przy przetwarzaniu obrazu
Apple: Obejście Pointer Authentication w iOS, macOS i innych platformach
Apple — memory corruption (RCE) w przetwarzaniu strumieni audio
Apple WebKit: out-of-bounds write umożliwiający ucieczkę z sandbox przeglądarki