CVE-2024-54546
Published: 10 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2024-54546 is a memory handling vulnerability affecting macOS versions prior to Sequoia 15. The issue, classified under CWE-400 (Uncontrolled Resource Consumption), was addressed through improved memory management in the kernel. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), indicating high integrity impact with no confidentiality or availability effects.
The vulnerability can be exploited by an unprivileged attacker over the network with low complexity and no user interaction required. A malicious app can trigger the flaw to corrupt kernel memory or cause unexpected system termination, potentially enabling further kernel-level disruptions or persistence mechanisms.
Apple's security advisory at https://support.apple.com/en-us/121238 confirms the fix in macOS Sequoia 15, recommending users update to the patched version to mitigate the issue. No additional workarounds are specified in available details.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Kernel memory corruption from user-space malicious app directly enables privilege escalation to kernel level; potential persistence is a secondary effect.