CVE-2022-32877

Vulnerability

A configuration issue in code signature validation was addressed with additional restrictions. This affects macOS Big Sur 11.7 and macOS Monterey 12.6, as fixed on September 12, 2022 [1][2][3]. The bug allows an app to bypass signature checks and access user-sensitive data without proper authorization [2][3].

Exploitation

An attacker would need to run a malicious app on the affected system. No special network position or authentication beyond the ability to execute the app is required. The app can exploit the flawed signature validation to gain access to user-sensitive data [2][3].

Impact

Successful exploitation allows the app to access user-sensitive data, such as personal files or credentials, violating confidentiality. The attacker gains the privilege level of the app without proper authorization [2][3].

Mitigation

Apple fixed this issue in macOS Big Sur 11.7 and macOS Monterey 12.6, released September 12, 2022 [1][2][3]. Users should update to these versions. No workarounds are available. This CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.