VORANT. Threat Intelligence Research Create a free account

0day Bypasses Apple SIP via Upgrade Process

PublishedThe source gives no date · added Vorant ratingroutine threat

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Researcher demonstrates an unpatched macOS 0day that abuses the local OS upgrade/bless process to bypass System Integrity Protection and implant undeletable malware.

Sourceobjective-see.org — open the original

What to check

Applies to
Whether this concerns you is not assessed; the names the report mentions are listed below.
Date
The source gives no publication date; the date shown is the day Vorant added the brief.

Patrick Wardle of Objective-See disclosed an unpatched 0day allowing attackers with existing local access to a macOS system to bypass System Integrity Protection (SIP), the OS-level sandbox introduced in El Capitan that restricts even root-level code from modifying protected system files. The technique abuses the local OS upgrade/installer workflow: the installer's helper process (osishelperd) carries the undocumented com.apple.rootless.install.heritable entitlement, which lets it and its children (including the bless utility) bypass SIP restrictions to set the startup disk to an installer disk image. Because the embedded InstallESD.dmg/BaseSystem.dmg upgrade images are not signature-verified before being blessed and booted, an attacker who has already compromised a Mac can hijack a local dylib within the installer app (via dylib proxying, since binary patching would break code signing) to hook the extractBootBits method and inject malicious code into BaseSystem.dmg before it is used to boot the second install phase.

Mentioned in this report

Malware iWorm

Source reporting: https://objective-see.org/blog/blog_0x14.html

Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account   What it costs