CME-305
macOS System Integrity Protection (SIP)
Description
Kernel-enforced protection that restricts root-level modification of protected system paths, kernel extensions, and system processes. Even processes running as root cannot modify /System, /usr (excluding /usr/local), pre-installed Apple applications, or inject code into system processes. Prevents rootkit installation, system file tampering, and kernel extension abuse. SIP is enforced by the kernel and cannot be disabled from within macOS; requires Recovery Mode boot to disable.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Requires SIP bypass exploit; root privilege insufficient to modify system files |
| Integrity (I) | H → N | System file modification prevented even with root access; tampering blocked at kernel level |
| Privileges Required (PR) | H → H | Root privilege retained but system modification rights restricted |
CWE Relationships
Verification
Verify SIP status and individual protection flags
$ csrutil status
# Expected: System Integrity Protection status: enabled.
# Expected: System Integrity Protection status: enabled.
Platform: macos
$ csrutil status | grep -c enabled
# Expected: 1
# Expected: 1
Platform: macos
$ nvram -p | grep csr-active-config
# Expected: No output (SIP fully enabled) or csr-active-config=%00%00%00%00
# Expected: No output (SIP fully enabled) or csr-active-config=%00%00%00%00
Platform: macos