Description
CoreStorage in Apple OS X before 10.10 retains a volume's encryption keys upon an eject action in the unlocked state, which makes it easier for physically proximate attackers to obtain cleartext data via a remount.
References
- macosx-cve20144430-sec-bypass(97639) vdb-entry
- 70628 vdb-entry
- APPLE-SA-2014-10-16-1 vendor-advisory
- 1031063 vdb-entry
- https://support.apple.com/kb/HT6535