CVE-2020-9847: 
macOS vulnerability analysis and mitigation

An out-of-bounds read vulnerability (CVE-2020-9847) was discovered in macOS that affects DiskArbitration component. The vulnerability was fixed in macOS Catalina 10.15.5, released on May 26, 2020. This security issue affected multiple versions of macOS including Mojave 10.14.6, High Sierra 10.13.6, and Catalina versions prior to 10.15.5 (Apple Advisory).

The vulnerability is an out-of-bounds read issue in the DiskArbitration component of macOS. The security flaw was addressed by implementing improved bounds checking in the system. The vulnerability has been assigned a CVSS v3.1 Base Score of 8.6 HIGH with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (NVD).

When exploited, this vulnerability could allow a malicious application to break out of its sandbox environment, potentially compromising the security boundaries established by macOS. This could lead to unauthorized access to protected system resources and potential privilege escalation (Apple Advisory).

The vulnerability requires local access and user interaction to be exploited. A malicious application could potentially trigger this vulnerability to escape sandbox restrictions. The vulnerability was discovered by Zhuo Liang of Qihoo 360 Vulcan Team working with 360 BugCloud (Apple Advisory).

Apple addressed this vulnerability in macOS Catalina 10.15.5, Security Update 2020-003 Mojave, and Security Update 2020-003 High Sierra. Users are advised to update their systems to these versions or later to protect against this vulnerability (Apple Advisory).