ClearanceKit vulnerabilities

In ClearanceKit before version 5.0.10, the ECDSA key used to sign the policy database is stored in the macOS keychain without ACL restrictions. Any root process can use this key to sign arbitrary policy content.

In ClearanceKit before version 5.0.10, ECDSA signatures for SQLite database tables lack a version counter or freshness binding. An attacker can replace the database and signatures with an older, legitimately signed version, which will be accepted by the system.

ClearanceKit has a startup defect where only compile-time rules are enforced until user interacts with GUI. MDM and user-defined rules are not applied.