CVE-2022-32794

Vulnerability

A logic issue exists in the macOS kernel or system services that allows an application to gain elevated privileges. The vulnerability is caused by improper state management. Affected versions: macOS Monterey before 12.4, macOS Big Sur before 11.6.6, and macOS Catalina before Security Update 2022-004 [1][2][3]. The issue requires no special configuration; any application on the system may potentially exploit it.

Exploitation

An attacker would need to run a malicious application on the affected macOS system. No additional privileges or user interaction are required beyond launching the app. The exploitation likely involves triggering a race condition or incorrect state transition during a privileged operation, leading to privilege escalation. No public exploit code has been disclosed.

Impact

Successful exploitation allows an application to gain elevated privileges, potentially up to root or kernel level. This could lead to full compromise of the system, including arbitrary code execution with kernel privileges, though the exact level is not specified.

Mitigation

The issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6, and Security Update 2022-004 for macOS Catalina, all released on May 16, 2022 [1][2][3]. Users should update to these versions. No workarounds are documented.