-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add module for CVE-2020-9934 #13942
Add module for CVE-2020-9934 #13942
Conversation
Thanks for your pull request! Before this can be merged, we need the following documentation for your module: |
Forgive my MacOS ignorance, but I'm guessing when you say earlier than 10.15.5, you mean 10.15.0 - 10.15.14? I tried this on 10.14 and 10.13, but neither needed the module to access Documents? |
|
Hey, just read over some of the code and it looks good! Here's just a few quick suggestions:
And while TCC has been a part of macOS since Mountain Lion, it only started actively restricting file access in Catalina so versions pre-Catalina aren't vulnerable per se. |
Apologies for the delay on this! I was prioritizing #13992 because I thought it would supplant this pr, but I suspect it is still useful. What was confusing for me was that even after adding |
So I looked into this recently, and while I haven't reversed all of tccd yet, there is actually a tccd instance (and corresponding TCC.db) per logged in user and also one system-wide. I don't know exactly where the delineation occurs, but it looks like some kTCCService entitlements are stored in the system-wide database at |
Thanks @mattshockl that makes a lot more sense now. Presumably if we disabled SIP, e.g with exploit 6) from https://github.com/sslab-gatech/pwn2own2020, we could write into that db and grant ourselves the permission. |
Yeah with SIP disabled (and logged in as root) you should be able to write directly to the system-wide TCC.db and the currently logged-in user's TCC.db to get all of the entitlements |
@bwatters-r7 fyi I think 10.15 -> 10.15.5 inclusive are vulnerable but I've only tested 10.15.3 and 10.15.4. |
|
34c3ed1
to
93cdba4
Compare
Release NotesNew module |
Add a quick module for CVE-2020-9934, ping @mattshockl
Verification