In plain words
Imagine you have a house with a special key that can unlock every door, and that key is supposed to be hidden safely. But what if someone found a way to get that key without breaking in. That is kind of like what is happening with these bugs, they are like hidden passages to get the special key.
What's broken
The bugs in question, like CVE-2019-8521¹ and CVE-2019-8565², are problems in the macOS system that allow an attacker to elevate their privileges to root³, which means they can do anything on the computer. An attacker can use these bugs to get control of the system without needing the password for the root account.
How it actually works
Here is how it actually works: an attacker finds a bug in the system, like CVE-2019-8521 or CVE-2019-8565, that lets them send a special request to the system, which then gives them the power to do things that only the root user should be able to do, like installing software or changing important settings. This is possible because the bugs allow the attacker to bypass the normal security checks that would stop them from doing these things.
Proof of concept
There is a proof of concept, or PoC⁴, that shows these bugs really work. A PoC is like a demonstration that the flaw is real and can be used, which makes it more urgent to fix. It proves that the bug is not just theoretical, but can actually be used by an attacker.
Is it real
It is not clear from the source if these bugs are being actively exploited in the wild. However, the fact that there is a PoC makes it more likely that attackers will try to use them.
What to do
To fix these bugs, users should update their macOS to the latest version, which includes patches for these vulnerabilities. This will prevent attackers from using these bugs to elevate their privileges.
Terms
- ¹ CVE
- , a unique identifier for a security vulnerability
- ² CVE
- , a unique identifier for a security vulnerability
- ³ root
- , the most powerful user account on a computer system, which has complete control over the system
- ⁴ PoC
- , a demonstration that a security flaw is real and can be used by an attacker