CVE-2025-24204 PoC — Apple macOS 安全漏洞

Description

PoC and technical details of CVE-2025-24204

介绍

# CVE-2025-24204

## About

CVE-2025-24204 is a vulnerability that allows reading any process memory on SIP-enabled macOS systems. The root cause of this vulnerability stems from adding an excessively powerful entitlement (`com.apple.system-task-ports.read`) to the `gcore` binary. Exploiting this vulnerability enables:
- [Dumping login keychain without user plaintext login password](./decrypt-keychain/)
- [Bypassing TCC and accessing sensitive information](./bypass-tcc/)
- [Decrypting FairPlay-encrypted iOS apps on Apple Silicon Macs](./decrypt-fairplay/)

## Author

Koh M. Nakagawa (@tsunek0h). © FFRI Security, Inc. 2025

## License

[Apache version 2.0](./LICENSE.txt)

文件快照

备注