# CVE-2023-32369 ## Identification CVE-2023-32369, called Migraine by Microsoft, was a macOS vulnerability in the Migration Assistant workflow. It involved the privileged systemmigrationd daemon and the inheritance of Apple’s private SIP-bypass entitlement by child processes. ## Mechanism The migration process launched Bash and Apple’s Perl program migrateLocalKDC beneath a parent carrying com.apple.rootless.install.heritable. Interpreter-control variables such as BASH_ENV and PERL5OPT could redirect execution, while undocumented Setup Assistant arguments altered how the migration branch proceeded. The exploit required preexisting root access. Its importance was privilege conversion: existing root control could be extended into mutation of locations protected by [[System Integrity Protection]]. ## Evidentiary boundary Migraine is a public analogue for an interpreter-mediated transition failure. It is not proof that the notebook’s [[InstallESD.dmg]] fragment records this vulnerability, and it does not establish kernel, firmware, or actor attribution. ## Relationships [[Migration Assistant]] · [[Perl]] · [[System Integrity Protection]] · [[Foundational Persistence]] · [[InstallESD.dmg]]. ## Source [[InstallESD.dmg#Perl, hidden arguments, and Migraine|InstallESD.dmg — Perl, hidden arguments, and Migraine]].