| 제목 | Magnetism Studios Endurance 3.3.0 Local Privilege Escalation |
|---|
| 설명 | Endurance 3.3.0 for macOS installs a privileged helper tool (com.MagnetismStudios.endurance.helper) that exposes an unauthenticated NSXPC interface. Any local user can connect to this interface and invoke sensitive methods without authorization. This allows execution of privileged functionality as root. The most critical method (loadModuleNamed:WithReply:) executes /usr/sbin/chown and /usr/bin/kextutil with attacker-controlled input.
With SIP enabled (default), the vulnerability results in local privilege escalation to root. If SIP is explicitly disabled (csrutil disable), an attacker can further abuse this method to load arbitrary kernel extensions, leading to kernel code execution. |
|---|
| 원천 | ⚠️ https://github.com/SwayZGl1tZyyy/n-days/blob/main/Endurance/README.md |
|---|
| 사용자 | SwayZGl1tZyyy (UID 88771) |
|---|
| 제출 | 2025. 09. 14. AM 03:44 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 09. 24. AM 10:10 (10 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 325691 [Magnetism Studios Endurance 까지 3.3.0 켜짐 macOS NSXPC Interface com.MagnetismStudios.endurance.helper loadModuleNamed:WithReply 약한 인증] |
|---|
| 포인트들 | 20 |
|---|