iPhone¤äMac¤Î¼Ì¿¿¡¦ÄÌÏÃÍúÎò¡¦¥á¥Ã¥»¡¼¥¸¤Ê¤É¤Ë¥¢¥¯¥»¥¹²Äǽ¤È¤Ê¤ë¥Ð¥°¤¬¸«¤Ä¤«¤ë

iOS¤ÈmacOS¤ÎξÊý¤Ç¡¢¥³¡¼¥É½ð̾¤ò¥Ð¥¤¥Ñ¥¹¤·¤ÆÇ¤°Õ¤Î¥³¡¼¥É¤ò¼Â¹Ô¤Ç¤¤ë¤è¤¦¤Ë¤Ê¤ëÀȼå(¤¼¤¤¤¸¤ã¤¯)À¤¬È¯¸«¤µ¤ì¤Þ¤·¤¿¡£¤³¤ÎÀȼåÀ¤ò°ÍѤ¹¤ë¤³¤È¤Ç¡¢¹¶·â¼Ô¤ÏiOS¡¦macOSÅëºÜüËö¤Î¼Ì¿¿¡¦ÄÌÏÃÍúÎò¡¦¥á¥Ã¥»¡¼¥¸¤Ê¤É¤Ë¥¢¥¯¥»¥¹¤¹¤ë¤³¤È¤¬²Äǽ¤Ë¤Ê¤ê¤Þ¤¹¡£
Trellix Advanced Research Center Discovers a New Privilege Escalation Bug Class on macOS and iOS
½éÂåiPhone¤ËiOS¤¬ÅëºÜ¤µ¤ì¤Æ°ÊÍè¡¢Apple¤Ï¼«¼ÒÀ½¤Î¥â¥Ð¥¤¥ëüËö¤Ç¼Â¹Ô¤Ç¤¤ë¥½¥Õ¥È¥¦¥§¥¢¤Ë¿µ½Å¤ËÀ©¸Â¤ò²Ý¤·¤Æ¤¤Þ¤·¤¿¡£¶ñÂÎŪ¤Ë¤Ï¡¢iPhone¤Ç¤ÏApple¤¬¿®Íꤹ¤ë³«È¯¼Ô¾ÚÌÀ½ñ¤Ë¤è¤Ã¤Æ½ð̾¤µ¤ì¤¿¥¢¥×¥ê¥±¡¼¥·¥ç¥ó¤Î¤ß¤¬¼Â¹Ô²Äǽ¤È¤Ê¤Ã¤Æ¤ª¤ê¡¢AppleScript¤Î¤è¤¦¤Ê¥¹¥¯¥ê¥×¥È¸À¸ì¤ÏiOS¤Ë¤Ï¸ºß¤·¤Þ¤»¤ó¡£¥³¡¼¥É¤òưŪ¤Ë¼Â¹Ô¤¹¤ëµ¡Ç½¤Ï¤Û¤Ü´°Á´¤Ëºï½ü¤µ¤ì¤Æ¤¤¤ë¤¿¤á¡¢°°Õ¤Î¤¢¤ë¥×¥í¥°¥é¥à¤ò¼Â¹Ô¤¹¤ë¤¿¤á¤ÎÊýË¡¤ò¸«¤Ä¤±¤ëɬÍפ¬¤¢¤ë¥¨¥¯¥¹¥×¥í¥¤¥È¤ËÂФ·¤Æ¡¢¶¯ÎϤʾãÊɤ¬·ÁÀ®¤µ¤ì¤Æ¤¤¤ë¤È¤¤¤¨¤Þ¤¹¡£¤½¤·¤Æ¡¢Apple¤¬macOS¤ËiOS¤Îµ¡Ç½¤ò°Ü¿¢¤¹¤ë¤Ë¤Ä¤ì¡¢macOS¤Ë¤ª¤¤¤Æ¤â¥³¡¼¥É½ð̾¤ò¸·Ì©¤Ë¶¯À©¤¹¤ë¤è¤¦¤Ë¤Ê¤Ã¤Æ¤¤¤¤Þ¤·¤¿¡£
¤·¤«¤·¡¢¥µ¥¤¥Ð¡¼¥»¥¥å¥ê¥Æ¥£´ë¶È¡¦Trellix¤Î¸¦µæÉôÌç¤Ç¤¢¤ëTrellix Advanced Research Center¤ÎÀȼåÀ¥Á¡¼¥à¤¬¡¢iOS¤ª¤è¤ÓmacOS¤Ç¥³¡¼¥É½ð̾¤ò¥Ð¥¤¥Ñ¥¹¤·¤ÆÊ£¿ô¤Î¥×¥é¥Ã¥È¥Õ¥©¡¼¥à¥¢¥×¥ê¥±¡¼¥·¥ç¥ó¤Î¥³¥ó¥Æ¥¥¹¥È¤ÇǤ°Õ¤Î¥³¡¼¥É¤ò¼Â¹Ô¤Ç¤¤ë¤è¤¦¤Ë¤¹¤ë¤³¤È¤¬¤Ç¤¤ë¤È¤¤¤¦¿·¤·¤¤ÀȼåÀ¤òȯ¸«¤·¤Þ¤·¤¿¡£¤³¤ÎÀȼåÀ¤Ë¤è¤ê¡¢iOS¤ÈmacOS¤ÎξÊý¤Ç¸¢¸Â¤Î¾º³Ê¤ª¤è¤Ó¥µ¥ó¥É¥Ü¥Ã¥¯¥¹²óÈò¤¬²Äǽ¤È¤Ê¤ê¤Þ¤¹¡£¤³¤ÎÀȼåÀ¤¬°°Õ¤Î¤¢¤ë¥¢¥×¥ê¥±¡¼¥·¥ç¥ó¤ä¥¨¥¯¥¹¥×¥í¥¤¥È¤ËÍøÍѤµ¤ì¤ì¤Ð¡¢¥æ¡¼¥¶¡¼¤Î¥á¥Ã¥»¡¼¥¸¡¦°ÌÃÖ¾ðÊó¡¦ÄÌÏÃÍúÎò¡¦¼Ì¿¿¤È¤¤¤Ã¤¿µ¡Ì©¾ðÊó¤Ë¥¢¥¯¥»¥¹¤µ¤ì¤ë²ÄǽÀ¤¬¤¢¤ë¤È¤Î¤³¤È¡£¤Ê¤ª¡¢¤³¤ÎÀȼåÀ¤Î½ÅÂçÅÙ¤ÏÃæ¤«¤é¹â¤Ç¡¢CVSS¥¹¥³¥¢¤Ï¡Ö5.1¡Á7.1¡×¤Ç¤¹¡£
°Ê²¼¤Î¥Ä¥¤¡¼¥È¤ËËä¤á¹þ¤Þ¤ì¤Æ¤¤¤ëư²è¤Ï¡¢Trellix¤¬È¯¸«¤·¤¿ÀȼåÀ¤òÍѤ¤¤Æ°°Õ¤Î¤¢¤ë¹¶·â¼Ô¤¬ÄÌÃΤä°ÌÃÖ¾ðÊó¤òÅð¤ß¼è¤ëÍͻҤò¤ï¤«¤ê¤ä¤¹¤¯¼¨¤·¤¿¤â¤Î¡£
Today, we published our discovery of a new bug class fundamentally affecting Apple¡Çs security model. Austin Emmitt (@alkalinesec) breaks down the full story on the blog. https://t.co/DwmPkn2O2s
Summary of our research (and a reminder to update your devices) below. ???? pic.twitter.com/YSJ0xxqSCG— Trellix Advanced Research Center (@TrellixARC) February 21, 2023
2021ǯ¡¢Citizen Lab¤ÏiPhone¸þ¤±¤Î¥¹¥Ñ¥¤¥¦¥§¥¢¡¦Pegasus¤ÇÍøÍѤµ¤ì¤¿¥¼¥í¥¯¥ê¥Ã¥¯¥¨¥¯¥¹¥×¥í¥¤¥È¤Î¡ÖFORCEDENTRY¡×¤òȯɽ¤·¤Þ¤·¤¿¡£Citizen Lab¤¬Google¼ÒÆâ¤Î¥¼¥í¥Ç¥¤ÀȼåÀ¤Îȯ¸«¤òǤ̳¤È¤¹¤ë¥»¥¥å¥ê¥Æ¥£¥Á¡¼¥à¤Ç¤¢¤ë¡ÖProject Zero¡×¤È¶¨ÎϤ·¤ÆFORCEDENTRY¤òʬÀϤ·¤¿·ë²Ì¡¢FORCEDENTRY¤ÏiOS¤¬²èÁü¤òÉÁ²è¤¹¤ë¤¿¤á¤Ë»ÈÍѤ¹¤ë¥Õ¥ì¡¼¥à¥ï¡¼¥¯¡¦Core Graphics¤ÎPDF½èÍý¤Ë¸ºß¤¹¤ëÀȼåÀ¤òɸŪ¤Ë¤¹¤ë¤³¤È¤ÇÊ£¿ô¤Î¥³¡¼¥É¤ò¼Â¹Ô²Äǽ¤È¤·¤Æ¤¤¤ë¤³¤È¤ä¡¢¥µ¥ó¥É¥Ü¥Ã¥¯¥¹²óÈò¤Î¥á¥«¥Ë¥º¥à¤òͤ·¤Æ¤¤¤ë¤³¤È¤¬ÌÀ¤é¤«¤Ë¤Ê¤Ã¤Æ¤¤¤Þ¤¹¡£
Í׿ʹƻë¤Ê¤É¤ËÍѤ¤¤é¤ì¤¿¥¹¥Ñ¥¤¥¦¥§¥¢¡¦Pegasus¤ÇÍøÍѤµ¤ì¤¿iPhone¸þ¤±¤Î¥¼¥í¥¯¥ê¥Ã¥¯¥¨¥¯¥¹¥×¥í¥¤¥È¤Ï¡Öµ»½ÑŪ¤ËºÇ¤âÀöÎý¤µ¤ì¤¿¥¨¥¯¥¹¥×¥í¥¤¥È¡×¤ÈGoogle¤ÎProject Zero¤¬»ØÅ¦ - GIGAZINE

¤³¤Î¥µ¥ó¥É¥Ü¥Ã¥¯¥¹²óÈò¥á¥«¥Ë¥º¥à¤Ë¤Ï¡¢³«È¯¼Ô¤¬Ç¤°Õ¤Î¥ª¥Ö¥¸¥§¥¯¥È¤Î¥ê¥¹¥È¤ò¥Õ¥£¥ë¥¿¥ê¥ó¥°¤Ç¤¤ë¤è¤¦¤Ë¤¹¤ëNSPredicate¤¬´Þ¤Þ¤ì¤Æ¤¤¤Þ¤·¤¿¡£NSPredicate¤Î¹½Ê¸¤Ï´°Á´¤Ê¥¹¥¯¥ê¥×¥È¸À¸ì¤Ç¤¢¤ë¤¿¤á¡¢iOS¤Ç¥³¡¼¥É¤òưŪ¤ËÀ¸À®¤·¤Æ¼Â¹Ô¤¹¤ë¤³¤È¤¬²Äǽ¤Ç¤¹¡£¤³¤ì¤Ë¤è¤ê¡¢macOS¤ª¤è¤ÓiOS¤Î¥×¥í¥»¥¹´Ö¥»¥¥å¥ê¥Æ¥£¤ò´°Á´¤ËÇˤ뤳¤È¤¬¤Ç¤¤ëÁ´¤¯¿·¤·¤¤ÀȼåÀ¤¬À¸¤Þ¤ì¤ë¤³¤È¤Ë¤Ê¤Ã¤¿¤ÈTrellix¤ÏÀâÌÀ¤·¤Æ¤¤¤Þ¤¹¡£
Trellix¤¬È¯¸«¤·¤¿ÀȼåÀ¤Ï¡¢¥Ç¥Ð¥¤¥¹¾å¤Îưºî¤Ë´Ø¤¹¤ë¥Ç¡¼¥¿¤ò¼ý½¸¤¹¤ë¥×¥í¥»¥¹¤Ç¤¢¤ë¡Öcoreduetd¡×¤Ë¸ºß¤·¤Æ¤¤¤Þ¤¹¡£¥á¥Ã¥»¡¼¥¸¤äSafari¤È¤¤¤Ã¤¿Å¬Àڤʻñ³Ê¤ò»ý¤Ä¥×¥í¥»¥¹¤Ç¥³¡¼¥É¤ò¼Â¹Ô¤·¡¢°°Õ¤Î¤¢¤ëNSPredicate¤òÁ÷¿®¤¹¤ë¤³¤È¤Ç¡¢¤³¤Î¥×¥í¥»¥¹¤Î¸¢¸Â¤Ç¥³¡¼¥É¤ò¼Â¹Ô¤¹¤ë¤³¤È¤¬¤Ç¤¤ë¤è¤¦¤Ë¤Ê¤ë¤È¤Î¤³¤È¡£¤³¤Î¥×¥í¥»¥¹¤ÏmacOS¤Ç¤Ïroot¸¢¸Â¤Ç¼Â¹Ô¤µ¤ì¤ë¤¿¤á¡¢¹¶·â¼Ô¤Ï¥æ¡¼¥¶¡¼¤Î¥«¥ì¥ó¥À¡¼¡¦Ï¢ÍíÀ衦¼Ì¿¿¤Ë¥¢¥¯¥»¥¹¤¹¤ë¤³¤È¤¬²Äǽ¤È¤Ê¤ê¤Þ¤¹¡£¤Þ¤¿¡¢Æ±¤¸±Æ¶Á¤ò»ý¤ÄÈó¾ï¤Ë¤è¤¯»÷¤¿ÌäÂ꤬´ØÏ¢¥×¥í¥»¥¹¤Î¡Öcontextstored¡×¤Ë¤â¸ºß¤¹¤ë¤¿¤á¡¢¹¶·â¼Ô¤¬Àȼå¤ÊXPC¥µ¡¼¥Ó¥¹¤ò»ÈÍѤ¹¤ë¤³¤È¤Ç¥Ç¥Ð¥¤¥¹¤Ø¤Î¥¢¥¯¥»¥¹¤¬Â¿¤¤¥×¥í¥»¥¹¤«¤é¥³¡¼¥É¤ò¼Â¹Ô¤Ç¤¤ë¤È¤¤¤¦FORCEDENTRY¤Î¤è¤¦¤Êµóư¤ò°ú¤µ¯¤³¤¹¤³¤È¤¬²Äǽ¤Ë¤Ê¤ë¤È¤Î¤³¤È¡£
iOS¤Î¡Öappstored¡×¤ª¤è¤ÓmacOS¤Î¡Öappstoreagent¡×¥Ç¡¼¥â¥ó¤Ë¤âÀȼå¤ÊXPC¥µ¡¼¥Ó¥¹¤¬¤¢¤ê¡¢¤³¤ì¤é¤Î¥Ç¡¼¥â¥ó¤ÈÄÌ¿®¤Ç¤¤ë¥×¥í¥»¥¹¤òÀ©¸æ¤¹¤ë¹¶·â¼Ô¤Ï¡¢ÀȼåÀ¤ò°ÍѤ·¤Æ¥·¥¹¥Æ¥à¥¢¥×¥ê¤ò´Þ¤àǤ°Õ¤Î¥¢¥×¥ê¥±¡¼¥·¥ç¥ó¤ò¥¤¥ó¥¹¥È¡¼¥ë¤¹¤ë¤³¤È¤¬²Äǽ¤È¤Ê¤ê¤Þ¤¹¡£
¤³¤ì¤é¤ÎÀȼåÀ¤Ï»ñ³Ê¤òɬÍפȤ·¤Ê¤¤¡¢Ç¤°Õ¤Î¥¢¥×¥ê¤Ç¥¢¥¯¥»¥¹²Äǽ¤Ê¥µ¡¼¥Ó¥¹¤Ë¤â¸ºß¤·¤Æ¤¤¤Þ¤¹¡£Trellix¤¬ÀȼåÀ¤òºÇ½é¤Ë¸«¤Ä¤±¤¿¤Î¤Ï¡ÖOSLogService¡×¤Ç¡¢¤³¤ì¤ÏXPC¥µ¡¼¥Ó¥¹¤Ç¤¢¤ê¡¢syslog¤«¤éÀøºßŪ¤Ë½ÅÍפʾðÊó¤òÆÉ¤ß¼è¤ë¤¿¤á¤ËÍøÍѤµ¤ì¤ë²ÄǽÀ¤¬¤¢¤ë¤È¤Î¤³¤È¡£¤µ¤é¤Ë¡¢¹¶·â¼Ô¤ÏiPad¤ÎUIKitCore¤ÎNSPredicate¤ÎÀȼåÀ¤ò°ÍѤ¹¤ë¤³¤È¤Ç¡¢°ÌÃÖ¾ðÊ󡦥«¥á¥é¡¦¥Þ¥¤¥¯¡¦ÄÌÏÃÍúÎò¡¦¼Ì¿¿¤Ê¤É¤Îµ¡Ì©¥Ç¡¼¥¿¤Ë¥¢¥¯¥»¥¹¤·¤¿¤ê¡¢¤³¤ì¤é¤Î¥Ç¡¼¥¿¤òüËö¾å¤«¤éºï½ü¤·¤¿¤ê¤¹¤ë¤³¤È¤â²Äǽ¤Ë¤Ê¤ëÌÏÍÍ¡£
¤Ê¤ª¡¢¾åµ¤ÎÀȼåÀ¤ÏApple¤¬¥ê¥ê¡¼¥¹¤·¤¿macOS 13.2¤ª¤è¤ÓiOS 16.3¤Ç½¤Àµ¤µ¤ì¤Æ¤ª¤ê¡¢¡ÖÌäÂê²ò·è¤Î¤¿¤á¤ËÊÀ¼Ò¤È¿×®¤Ë¶¨ÎϤ·¤Æ¤¯¤À¤µ¤Ã¤¿Apple¤Ë´¶¼Õ¤·¤Þ¤¹¡×¤ÈTrellix¤Ïµ¤·¤Æ¤¤¤Þ¤¹¡£
