CVE-2025-24204

Published Mar 31, 2025

Last updated 5 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-24204 is a vulnerability in macOS Sequoia 15.0 where the `/usr/bin/gcore` utility was mistakenly granted the `com.apple.system-task-ports.read` entitlement. This allowed the utility to read the memory of any process on the system, even with System Integrity Protection (SIP) enabled. Apple addressed this issue with improved checks in macOS Sequoia 15.4. The vulnerability allowed access to protected user data. A researcher discovered that this broke a key security boundary and exposed sensitive user data, including the contents of the Keychain, data protected by Transparency, Consent, and Control (TCC), and even encrypted iOS app binaries. By dumping memory of apps, the contents of protected files could be recovered.

Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data.
Source: product-security@apple.com
NVD status: Analyzed
Products: macos

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-200

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E3BD0A90-23F1-430A-8119-E14055F7E621",
            "versionEndExcluding": "15.4"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.