dunihiz/ph-n-t-ch-cve-2024-40842-xprotectremediatordubrobber-information-leak-tr-n-macosbee
CVE-2024-40842 is a local information disclosure vulnerability in Apple's XProtect Remediator on macOS, related to the module:
XProtectRemediatorDubRobber
The vulnerability stems from Apple's privileged security process unsafely handling the environment variable MAGIC.
A malicious app running on the machine can exploit this behavior to make XProtect read data that the app normally would not have access to.
Apple describes the impact:
An app may be able to access user-sensitive data.
Apple fixed the issue in macOS Sequoia 15 by improving validation and sanitization of environment variables.
| Property | Information |
|---|---|
| CVE | CVE-2024-40842 |
| Component | Apple XProtect |
| Related Module | XProtectRemediatorDubRobber |
| Vulnerability Type | Information Disclosure |
| Attack Vector | Local |
| Initial Root Privileges | Not required |
| Primary Impact | Access to sensitive data |
| Patch Released | macOS Sequoia 15 |
| Researcher | Gergely Kalman |
| Severity Reference | Medium |
XProtect is the anti-malware system built into macOS. It works together with:
XProtect Remediator is responsible for scanning and removing malware that already exists on the machine.
This system includes multiple modules. Each module is designed to handle a specific malware family.
XProtectRemediatorDubRobber is used to detect DubRobber, also known as XCSSET.
Because it needs to scan many areas of the system, XProtect Remediator runs with higher privileges than a normal application.
The vulnerability is related to the environment variable:
MAGIC