{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/macos--12.7.2-13.6.3-14.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2023-42931"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["macOS (\u003c 12.7.2, 13.6.3, 14.2)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","macos","local-exploitation"],"_cs_type":"threat","_cs_vendors":["Apple"],"content_html":"\u003cp\u003eCVE-2023-42931 is a local privilege escalation vulnerability affecting multiple versions of macOS, including Monterey, Ventura, and Sonoma. The vulnerability resides in the 'diskutil' command-line utility, which fails to properly restrict filesystem mounting options when invoked by unprivileged users. An attacker can leverage this flaw to gain full root control of the host system. The vulnerability was publicly disclosed alongside a functional proof-of-concept exploit that automates the exploitation process. The exploit targets how 'diskutil' manages filesystem permissions, allowing for the deployment and execution of setuid binaries. Given the availability of this exploit code, unpatched systems are at significant risk of unauthorized administrative access.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe unprivileged attacker initiates the exploit script on a local macOS endpoint.\u003c/li\u003e\n\u003cli\u003eThe script interacts with the 'diskutil' utility to trigger a filesystem mount operation.\u003c/li\u003e\n\u003cli\u003eThe attacker provides crafted filesystem options to 'diskutil' to bypass existing security restrictions.\u003c/li\u003e\n\u003cli\u003eThe script creates a malicious setuid shell payload.\u003c/li\u003e\n\u003cli\u003eThe payload is moved to a target placeholder file on the mounted filesystem.\u003c/li\u003e\n\u003cli\u003eThe script uses 'diskutil' or system utilities to explicitly set the setuid bit on the malicious binary.\u003c/li\u003e\n\u003cli\u003eThe attacker executes the setuid binary to execute code with root privileges.\u003c/li\u003e\n\u003cli\u003eThe final objective is the acquisition of a root shell for full system control and persistence.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2023-42931 results in a full local privilege escalation, granting the attacker root privileges on the compromised macOS device. This provides the actor with unrestricted access to sensitive user data, system configuration, and the ability to disable security controls or maintain persistent access. The vulnerability affects macOS versions prior to 12.7.2, 13.6.3, and 14.2.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePrioritize updating all macOS endpoints to versions 12.7.2, 13.6.3, 14.2 or later to patch CVE-2023-42931.\u003c/li\u003e\n\u003cli\u003eMonitor process execution logs for suspicious usage of 'diskutil' in combination with setuid or chmod commands by non-administrative users.\u003c/li\u003e\n\u003cli\u003eReview audit logs for instances where non-privileged accounts successfully elevate to root (uid 0) using unauthorized binaries.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T10:33:12Z","date_published":"2026-10-16T10:33:12Z","id":"https://feed.craftedsignal.io/briefs/2026-10-macos-privesc/","summary":"A local privilege escalation vulnerability in the macOS diskutil utility allows unprivileged users to gain root access via manipulated filesystem mounting.","title":"CVE-2023-42931 Privilege Escalation in macOS diskutil","url":"https://feed.craftedsignal.io/briefs/2026-10-macos-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - MacOS (\u003c 12.7.2, 13.6.3, 14.2)","version":"https://jsonfeed.org/version/1.1"}