Unpatched Kernel-Level Vulnerability in IBM Security Tool for Apple MacOS Revealed

Researchers expose signedness bug in motive force utilized by IBM Trusteer Rapport endpoint safety device after IBM fails to supply well timed patch.

A kernel-level bug in an endpoint security tool for MacOS remains unpatched after IBM was unable to deliver a patch within the vulnerability researchers’ 120-day disclosure deadline.

IBM Trusteer Rapport is endpoint security software that protects confidential data like access credentials. Researchers from Trustwave SpiderLabs discovered a signedness bug in the handling of user-supplied buffers on a driver used by Trusteer Rapport on MacOS. The bug can lead to a memory corruption vulnerability in the Apple MacOS kernel and, subsequently, arbitrary code execution in the kernel. 

Trustwave SpiderLabs researchers first reported the bug to IBM Aug. 15 and have been working with the IBM Security Vulnerability Management Team since then, researchers wrote Thursday. When IBM was unable to provide a patch within Trust wave’s normal 90-day disclosure policy, the researchers granted IBM an additional 30 days. When that deadline again passed without a fix, Trust wave opted to publicly disclose the bug.

The good news is that the vulnerability can only be exploited locally. However, there are several exploits in which attackers could obtain arbitrary code executions within the context of the kernel, researchers said. Security teams should take measures to ensure only authorized users can obtain local access to affected machines.

Leave a Reply

Your email address will not be published. Required fields are marked *