macOS TimeMachine XPC flaws enabled root LPE
Two macOS local privilege escalation bugs (CVE-2019-8513, CVE-2019-8530) in TimeMachine diagnostic helpers allowed reliable root access; patched in 10.14.4.
Sourceobjective-see.org — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- A public exploit is recorded for CVE-2019-8513 (weaponized); no exploitation in the wild is recorded.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
Researchers detailed two local privilege escalation vulnerabilities affecting macOS 10.12.x through 10.14.3, both residing in Apple's TimeMachine diagnostic XPC helpers. CVE-2019-8530 is an arbitrary file write issue in the timemachinehelper XPC service, which fails to validate the destination directory before writing diagnostic logs, previously combinable with a since-patched sudo timestamp flaw to escalate privileges. CVE-2019-8513 is a command injection vulnerability in the tmdiagnose binary, where output from `diskutil list` is piped into an awk/system() call; by crafting a malicious disk image volume label containing CRLF and shell metacharacters, an attacker could inject arbitrary shell commands executed as root.
Mentioned in this report
Detection guidance
tmdiagnose Command Injection via Crafted Disk Volume Label
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
tmdiagnose binary executing shell commands with metacharacters/CRLF injected through disk volume labels processed by diskutil and awk. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: tmdiagnose Command Injection via Crafted Disk Volume Label
description: Detects tmdiagnose binary spawning shell commands (sh/bash) with arguments
containing shell metacharacters or CRLF sequences, indicative of command injection
through malicious disk volume labels processed by diskutil piped to awk/system().
tags:
- attack.execution
- attack.t1059.004
- attack.privilege-escalation
- attack.t1068
logsource:
category: process_creation
product: macos
detection:
selection:
ParentImage|endswith: /tmdiagnose
Image|endswith:
- /sh
- /bash
CommandLine|contains:
- $(\x0a
- '`\x0a'
- '|\x0a'
- ;\x0a
- '&&\x0a'
- '||\x0a'
filter_legitimate_tmdiagnose:
CommandLine|contains:
- /bin/sh -c /usr
- /bin/bash -c /usr
condition: selection and not filter_legitimate_tmdiagnose
falsepositives:
- Legitimate tmdiagnose diagnostic collection with intentional shell piping
- macOS system diagnostics tools performing multi-stage command processing
level: high
id: 7170b440-281d-5669-b92b-a0c69902e709
status: experimental
author: Vorant
TimeMachineHelper XPC Service Spawning Privileged Shell
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
timemachinehelper XPC daemon spawning shell interpreters to execute diagnostic or system commands, potential privilege escalation vector. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: TimeMachineHelper XPC Service Spawning Privileged Shell
description: Detects timemachinehelper XPC process spawning sh/bash, indicative of
command execution leveraging the XPC service's elevated privileges for privilege
escalation.
tags:
- attack.privilege-escalation
- attack.t1068
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: macos
detection:
selection:
ParentImage|endswith: /timemachinehelper
Image|endswith:
- /sh
- /bash
filter_legitimate_diagnostics:
CommandLine|contains:
- /bin/sh -c /usr/bin/log
- /bin/sh -c diskutil
- /bin/sh -c /Library/Application Support/
condition: selection and not filter_legitimate_diagnostics
falsepositives:
- Legitimate Time Machine diagnostic collection invoking shell helpers
- macOS system maintenance tasks using timemachinehelper for subprocess execution
level: medium
id: f1c6f1dc-6d51-5f5e-bdc2-3b72aaded5b2
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x40.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs