What happened
Several Apple products, including iOS, iPadOS, macOS, Safari, tvOS and watchOS, are impacted by a vulnerability identified as CVE-2024-27834. The weakness involves an improper authentication process that could allow an attacker with arbitrary read and write capabilities to bypass pointer authentication. The vulnerability is actively exploited in the wild, indicating that malicious actors are utilising this flaw for malicious purposes. The exploitation requires local access to the affected device or host and assumes a low-privileged account is already in place. No action from the user is necessary for the exploit to succeed, which enhances the threat severity. Attackers with existing access can leverage this vulnerability to bypass security controls designed to verify device or application authenticity, potentially leading to further security breaches or data exposure. The issue impacts several Apple platforms, with specific versions vulnerable: Safari versions prior to 17.5, iOS and iPadOS versions before 16.7.8 and 17.5, macOS versions before 14.5, tvOS versions before 17.5, and watchOS versions before 10.5.. A fix addressing this vulnerability is available, as confirmed by the vendor. Organisations running affected Apple products should apply the latest updates recommended by Apple to mitigate the threat.
Who is affected
Organisations running Apple iOS, iPadOS, macOS, Safari, tvOS, or watchOS versions prior to the specific patch levels are affected by this vulnerability. The impact is limited to devices with vulnerable software installed, and exploitability depends on the presence of an attacker who already has local access to the device or host. Devices with up-to-date patches are not vulnerable to this particular issue.
Recommended actions
- Apply the latest available updates and patches from Apple for Safari, iOS, iPadOS, macOS, tvOS, and watchOS, according to vendor advisories.
- Review endpoint security policies to strengthen privilege hygiene and prevent unauthorized local access to devices.
- Implement endpoint monitoring to detect signs of exploitation, especially on devices with known vulnerabilities or suspicious activity.
