CVE-2024-44152 Overview
CVE-2024-44152 is an information disclosure vulnerability in Apple macOS. The flaw stems from insufficient redaction of private data within log entries. A local application can read these log entries and obtain user-sensitive information that should have been masked. Apple resolved the issue in macOS Sequoia 15 by improving private data redaction logic for log output. The vulnerability is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
An application running on an affected macOS system can access user-sensitive data exposed through log entries, undermining privacy controls and enabling reconnaissance for further attacks.
Affected Products
- Apple macOS versions prior to macOS Sequoia 15
- Systems running unpatched macOS builds with the affected logging subsystem
- Endpoints where third-party applications can read system or application logs
Discovery Timeline
- 2024-09-17 - CVE-2024-44152 published to the National Vulnerability Database
- 2024-09-17 - Apple publishes Apple Support Document #121238 covering the macOS Sequoia 15 fix
- 2025-11-04 - Last updated in the NVD database
Technical Details for CVE-2024-44152
Vulnerability Analysis
The vulnerability resides in the macOS logging subsystem, which is responsible for capturing diagnostic and runtime events. macOS uses a unified logging facility that classifies fields as public or private. Private fields should be redacted by default before being written to persistent log stores. In affected versions, certain log entries failed to apply this redaction. As a result, sensitive values intended to be masked were stored in clear form within the log database.
An application with permission to read log entries can query these records and recover the unredacted data. The data accessible through this channel can include identifiers and other user-sensitive values. Apple addressed the issue by tightening the redaction policy applied to log entries in macOS Sequoia 15.
Root Cause
The root cause is improper handling of the privacy classification applied to log fields, classified as [CWE-200]. The logging subsystem emitted fields that should have been treated as private without applying the expected redaction routine. This caused sensitive runtime values to be persisted in cleartext within log storage.
Attack Vector
The attack vector requires an attacker-controlled or attacker-influenced application running on the target macOS system. The application reads log entries through standard logging APIs and extracts the exposed sensitive values. No user interaction beyond running the malicious application is required, and the data is retrieved without elevated privileges in scenarios where log read access is granted.
No verified public exploit code is available. Refer to the Apple Support Document #121238 and the Full Disclosure list post for vendor and community discussion of the issue.
Detection Methods for CVE-2024-44152
Indicators of Compromise
- Unsigned or unexpected processes invoking log show, log stream, or the OSLog framework to harvest log entries
- Applications reading from /var/db/diagnostics/ or /var/db/uuidtext/ outside of normal diagnostic workflows
- Large or repeated exports of unified log archives (.logarchive) to user-writable locations
Detection Strategies
- Inventory macOS endpoints and identify hosts running builds older than macOS Sequoia 15
- Audit processes that enumerate unified log entries and correlate against an approved diagnostic tools list
- Alert on applications requesting log access entitlements that are not part of an approved baseline
Monitoring Recommendations
- Forward macOS endpoint telemetry, including process execution and file access events, to a centralized analytics platform
- Monitor invocation of log command-line tooling by non-administrative users and unsigned binaries
- Track creation and exfiltration of .logarchive bundles from user directories
How to Mitigate CVE-2024-44152
Immediate Actions Required
- Upgrade all affected systems to macOS Sequoia 15 or later, where the redaction logic has been corrected
- Restrict installation of untrusted third-party applications that request log access
- Review and revoke unnecessary log-read entitlements granted to existing applications
Patch Information
Apple fixed CVE-2024-44152 in macOS Sequoia 15. Administrators should deploy the update referenced in Apple Support Document #121238 across all managed macOS endpoints. Mobile Device Management (MDM) profiles can enforce minimum OS versions to prevent regressions.
Workarounds
- Limit local application installation through MDM allowlisting until patches are applied
- Reduce log retention periods to shrink the window during which sensitive data is recoverable
- Apply System Integrity Protection and standard sandboxing controls to constrain access to log stores
# Verify the installed macOS version meets the patched baseline
sw_vers -productVersion
# Enforce a minimum OS version via MDM (example configuration key)
# softwareupdate.allowPreReleaseInstallation = false
# softwareupdate.requiredMinimumOSVersion = "15.0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
