Microsoft points out a new macOS vulnerability ‘Migraine’ that could bypass System Integrity Protection
According to Microsoft, Migraine could bypass the System Integrity Protection of macOS and lead to arbitrary code execution on a device.
Apple MacOS is considered safer in terms of malware attacks as compared to Microsoft’s Windows OS. However, Microsoft has recently spotted and reported a new vulnerability referred as ‘Migraine’ which could allow an attacker to automatically bypass System Integrity Protection (SIP) in macOS and perform arbitrary operations on a device. The findings were shared by Microsoft with Apple and the fix was included in the latest security update by Apple.
What does ‘Migraine’ do?
According to Microsoft, Migraine could bypass the System Integrity Protection of macOS and lead to arbitrary code execution on a device. Arbitrary code execution means that an attacker can run any commands or code of the attacker’s choice on a target’s computer. The exploit is named ‘Migraine’ because it is related to the macOS Migration Assistant. This tool helps users to move data from a Mac/ Windows PC to another Mac.
Migraine can allow an attacker to automatically bypass System Integrity Protection (SIP) in macOS. SIP is a security technology in macOS that restricts a root user from performing operations that may compromise system integrity. Bypassing SIP could lead to serious consequences, such as increasing the potential for attackers and malware authors to successfully install rootkits, create persistent malware, and expand the attack surface for additional techniques and exploits.
Microsoft’s team discovered this malware during its routine malware hunting and it found it similar to Shrootless vulnerability (CVE-2021-30892) that was found in 2021 by the company.
‘’By focusing on system processes that are signed by Apple and have the com.apple.rootless.install.heritable entitlement, we found two child processes that could be tampered with to gain arbitrary code execution in a security context that bypasses SIP checks,’’ said Microsoft in its blog.
macOS 13.4 update
In its latest version of macOS Ventura which is the macOS 13.4, Apple has already fixed the issue. In order to update your Mac user can follow the following steps System Settings > General > Software Update.
Ms Kalinga