Security restrictions bypass in Apple macOS Sierra

1) ‘Synthetic’ Mouse-Click Attack

EUVDB-ID: #VU14318

Risk: Low

CVSSv3.1: 8.1 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2017-7150

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to conduct Synthetic Mouse-Click attacks.

The weakness exists due to two consecutive synthetic mouse “down” events were incorrectly interpreted by High Sierra as a manual approval. A local attacker can leverage vulnerabilities in third-party kernel extensions to bypass Apple’s kernel code-signing requirements, virtually “click” a security prompt and load a malicious kernel extension to compromise the vulnerable system.

Mitigation

Cybersecurity Help is currently unaware of any solutions addressing the vulnerability.

Vulnerable software versions

macOS: 10.13 17A365

External links

http://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Patrick%20Wardle/DEFCON-26-Pa...

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.