PrivilegedHelperTool XPC Service Privilege Escalation via TOCTOU Race Condition

Executive Summary

This vulnerability involves improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service of the Cato Client on macOS versions before 5.13.1.

A local authenticated attacker can exploit this by using a self-signed certificate that bypasses the XPC caller verification process and performing a symlink swap during package installation.

This allows the attacker to escalate their privileges to root on the affected system.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows a local authenticated attacker to escalate privileges to root, which means they can gain full control over the affected macOS system.

With root privileges, the attacker can execute arbitrary code, modify system files, install malicious software, and potentially compromise the confidentiality, integrity, and availability of the system.

Useful 0 Not Useful 0