CVE-2018-15367

Vulnerability

The vulnerability resides in the ctl_set KERedirect kernel extension (kext) of Trend Micro Antivirus for Mac (Consumer) versions 7.0 (2017) and above. The issue stems from the lack of proper validation of a user-supplied value before it is dereferenced as a pointer, leading to an untrusted pointer dereference condition [1].

Exploitation

An attacker must first obtain the ability to execute low-privileged code on the target system. Exploitation does not require any additional privileges or user interaction beyond the initial low-privileged execution. The attacker can trigger the vulnerability by providing a crafted value to the affected function, causing the kernel to dereference an untrusted pointer [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the kernel, resulting in privilege escalation and full compromise of the system. This could lead to unauthorized access to sensitive data, installation of persistent malware, or other malicious activities with highest system privileges [1].

Mitigation

As of the publication date, no official patch or fixed version has been released by Trend Micro. Users are advised to limit local access to trusted users and monitor for vendor updates. No workarounds have been disclosed in the available references [1].