CVE-2024-27837: 
macOS vulnerability analysis and mitigation

CVE-2024-27837 is a security vulnerability affecting macOS Sonoma versions prior to 14.5, discovered and reported by Mickey Jin (@patch1t) and ajajfxhj. The vulnerability was disclosed on May 13, 2024, as part of Apple's security update for macOS Sonoma 14.5. This downgrade issue in AppleMobileFileIntegrity component could allow a local attacker to gain access to Keychain items (Apple Support, NVD).

The vulnerability is a downgrade issue in the AppleMobileFileIntegrity component of macOS Sonoma that was addressed with additional code-signing restrictions. According to the National Vulnerability Database, the vulnerability has a CVSS v3.1 base score of 3.3 (LOW) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating local access is required. However, CISA-ADP assessed it with a higher CVSS score of 7.7 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (NVD).

The vulnerability allows a local attacker to gain unauthorized access to Keychain items, which could potentially expose sensitive user credentials and security-related data stored in the macOS Keychain (Apple Support).

The vulnerability requires local access to the system to be exploited. No public exploits have been reported in the wild at the time of the disclosure (Apple Support).

Apple has addressed this vulnerability in macOS Sonoma 14.5 by implementing additional code-signing restrictions. Users are advised to update their systems to macOS Sonoma 14.5 or later to protect against this vulnerability (Apple Support).