FKIE_CVE-2024-8272

Vulnerability from fkie_nvd - Published: 2024-11-25 18:15 - Updated: 2024-11-25 18:15
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
The com.uaudio.bsd.helper service, responsible for handling privileged operations, fails to implement critical client validation during XPC inter-process communication (IPC). Specifically, the service does not verify the code requirements, entitlements, or security flags of any client attempting to establish a connection. This lack of proper validation allows unauthorized clients to exploit the service's methods and escalate privileges to root.
References
41c37e40-543d-43a2-b660-2fee83ea851ahttps://pentraze.com/vulnerability-reports
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The com.uaudio.bsd.helper\u00a0service, responsible for handling privileged operations, fails to implement critical client validation during XPC inter-process communication (IPC). Specifically, the service does not verify the code requirements, entitlements, or security flags of any client attempting to establish a connection. This lack of proper validation allows unauthorized clients to exploit the service\u0027s methods and escalate privileges to root."
    },
    {
      "lang": "es",
      "value": "El servicio com.uaudio.bsd.helper, responsable de gestionar operaciones privilegiadas, no implementa una validaci\u00f3n cr\u00edtica del cliente durante la comunicaci\u00f3n entre procesos (IPC) de XPC. En concreto, el servicio no verifica los requisitos de c\u00f3digo, los derechos ni los indicadores de seguridad de ning\u00fan cliente que intente establecer una conexi\u00f3n. Esta falta de validaci\u00f3n adecuada permite que clientes no autorizados exploten los m\u00e9todos del servicio y escalen privilegios a superusuario."
    }
  ],
  "id": "CVE-2024-8272",
  "lastModified": "2024-11-25T18:15:14.673",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "41c37e40-543d-43a2-b660-2fee83ea851a",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-11-25T18:15:14.673",
  "references": [
    {
      "source": "41c37e40-543d-43a2-b660-2fee83ea851a",
      "url": "https://pentraze.com/vulnerability-reports"
    }
  ],
  "sourceIdentifier": "41c37e40-543d-43a2-b660-2fee83ea851a",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "41c37e40-543d-43a2-b660-2fee83ea851a",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.