CVE-2023-42931 Detection: Critical macOS Vulnerability Enabling Easy Privilege Escalation and Root Access

Security researchers warn of a critical privilege escalation vulnerability in multiple macOS versions that enables unauthorized users, including those with guest rights, to gain full root access to the affected instance.

Detect CVE-2023-42931 Exploitation Attempts

With an exponential rise in attack volumes and sophistication, the threat landscape of 2024 is assumed to be even more challenging than last year. The cost of cyber attacks on the global economy is estimated to top US$10.5 trillion by the end of 2024. Taking into account 29K+ new CVEs discovered in 2023, with a 14,5% surge predicted for 2024, security professionals require advanced solutions to detect and defend from threats proactively. 

To help security professionally detect malicious activity linked to CVE-2023-42931 exploitation, SOC Prime Platform for collective cyber defense offers a curated Sigma rule based on the proof-of-concept (PoC) exploit publicly accessible on the web.

Possible CVE-2023-42931 (MacOS Privilege Escalation) Exploitation Attempt (via cmdline)

The rule above is compatible with 23 SIEM, EDR, XDR, and Data Lake technologies and mapped to the MITRE ATT&CK framework v14. 

Cyber defenders can dive into the entire detection stack aimed at vulnerability exploit detection to boost SOC efficiency and smooth out threat investigation. Hit the Explore Detections button below, and drill down to the extensive collections of Sigma rules enriched with relevant metadata. Specifically, rules are accompanied by CTI links, ATT&CK references, triage recommendations, attack timelines, and more.

Explore Detections

CVE-2023-42931 Analysis

According to the detailed analysis by Yann Gascuel from Alter Solutions, CVE-2023-42931 stems from a “diskutil” command line utility accepting mount options via the “-mountOptions” arguments. Specifically, any local threat actor, including the one with guest rights, can mount filesystems with specific options, successfully elevating privileges to root. 

Specifically, adversaries might modify a root-owned file into any desired arbitrary binary and add the setuid bit to it leveraging diskutil -mountOptions parameter to end up with a filesystem having a ¨noowners¨ flag. Consequently, this would result in privilege escalation when the file in the limelight would be remounted in ¨owners¨ mode. 

Although the routine looks pretty easy, security researcher indicates that macOS´s modern disk/filesystem hierarchy and the protective measures of System Integrity Protection (SIP) prevent malicious modifications of sensitive system files at the kernel level. Yet, Yann Gascuel devised a working exploit path to overcome the protections.

CVE-2023-42931 vulnerability affects macOS Monterey prior to 12.7.2, macOS Ventura prior to 13.6.3, and macOS Sonoma prior to 14.2. Following the flaw has been reported to the vendor, Apple issued a patch in macOS versions Sonoma 14.2, Ventura 13.6.3, and Monterey 12.7.2. 

The increasing sophistication and an exponential rise in attack volumes require ultra-responsiveness from defenders backed by innovative technologies and collective cyber defense. Get started with Uncoder IO, an open-source IDE for Detection Engineering, to help you write faster and better detection code against emerging threats, streamline IOC matching, and translate rules into multiple cybersecurity languages on the fly. Contribute to Uncoder on GitHub to help us evolve the project and foster industry collaboration at scale.