Vulnerability · Published Nov 25, 2024 · Assigned by Pentraze
CVE-2024-8272macOS Universal Audio (UAConnect) <= 2.7.0 - Local Privilege Escalation
High 7.8
In plain English
A high-severity missing authorization in UAConnect from Universal Audio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Official description
The com.uaudio.bsd.helper service, responsible for handling privileged operations, fails to implement critical client validation during XPC inter-process communication (IPC). Specifically, the service does not verify the code requirements, entitlements, or security flags of any client attempting to establish a connection. This lack of proper validation allows unauthorized clients to exploit the service's methods and escalate privileges to root.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Universal Audio | UAConnect | 0 – through 2.7.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H