macOS TimeMachine XPC flaws enabled root LPE
Two macOS local privilege escalation bugs (CVE-2019-8513, CVE-2019-8530) in TimeMachine diagnostic helpers allowed reliable root access; patched in 10.14.4.
Researchers detailed two local privilege escalation vulnerabilities affecting macOS 10.12.x through 10.14.3, both residing in Apple's TimeMachine diagnostic XPC helpers. CVE-2019-8530 is an arbitrary file write issue in the timemachinehelper XPC service, which fails to validate the destination directory before writing diagnostic logs, previously combinable with a since-patched sudo timestamp flaw to escalate privileges. CVE-2019-8513 is a command injection vulnerability in the tmdiagnose binary, where output from `diskutil list` is piped into an awk/system() call; by crafting a malicious disk image volume label containing CRLF and shell metacharacters, an attacker could inject arbitrary shell commands executed as root.
Mentioned in this report
Source reporting: https://objective-see.org/blog/blog_0x40.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free