CVE-2025-24204 PoC — Apple macOS 安全漏洞

Source

https://github.com/FFRI/CVE-2025-24204

Associated Vulnerability

Title:Apple macOS 安全漏洞 (CVE-2025-24204)
Description:The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data.

Description

PoC and technical details of CVE-2025-24204

Readme

# CVE-2025-24204

## About

CVE-2025-24204 is a vulnerability that allows reading any process memory on SIP-enabled macOS systems. The root cause of this vulnerability stems from adding an excessively powerful entitlement (`com.apple.system-task-ports.read`) to the `gcore` binary. Exploiting this vulnerability enables:
- [Dumping login keychain without user plaintext login password](./decrypt-keychain/)
- [Bypassing TCC and accessing sensitive information](./bypass-tcc/)
- [Decrypting FairPlay-encrypted iOS apps on Apple Silicon Macs](./decrypt-fairplay/)

## Author

Koh M. Nakagawa (@tsunek0h). © FFRI Security, Inc. 2025

## License

[Apache version 2.0](./LICENSE.txt)

File Snapshot


 [4.0K]  /data/pocs/9774d5d5c2f651208c014b82cbd16655a84098bd
├── [4.0K]  bypass-tcc
│   ├── [ 53K]  example.png
│   ├── [9.0K]  main.py
│   ├── [ 225]  pyproject.toml
│   ├── [1.0K]  README.md
│   └── [ 16K]  uv.lock
├── [4.0K]  decrypt-fairplay
│   ├── [ 12K]  main.py
│   ├── [ 254]  pyproject.toml
│   ├── [1.3K]  README.md
│   └── [ 13K]  uv.lock
├── [4.0K]  decrypt-keychain
│   ├── [3.3K]  main.py
│   ├── [ 390]  pyproject.toml
│   ├── [ 278]  README.md
│   └── [ 25K]  uv.lock
├── [4.0K]  docs
│   └── [ 14K]  README.md
├── [ 11K]  LICENSE.txt
└── [ 679]  README.md

4 directories, 16 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!