CVE-2024-27834 was successfully exploited at the Pwn2Own Vancouver 2024 hacking contest. Exploits discovered in this way are not usually publicly disclosed for 90 days.

While exploitation has not been observed in the wild for this vulnerability, the existence of an as-yet undisclosed working exploit makes the possibility more likely.

Introduction

Apple has released a security update to address one zero-day vulnerability and several other vulnerabilities for multiple products.

The zero-day vulnerability in the Safari web browser, which has been designated CVE-2024-27834, has a CVSSv3 score of 9.1 and could allow an attacker with arbitrary read and write capability to bypass pointer authentication.

Additional CVEs added to advisories

Apple has added 45 new CVE designations to the below advisories.

Threat updates

Date	Update
11 Jun 2024	Additional CVEs added to advisories The cyber alert has been updated to reflect this

Remediation advice

Affected organisations are encouraged to review the Apple security summary and apply any relevant updates or workarounds.

Remediation steps

Type	Step
Patch	Safari 17.5 \| HT214103 https://support.apple.com/en-us/HT214103
Patch	iOS 17.5 and iPadOS 17.5 \| HT214101 https://support.apple.com/en-us/HT214101
Patch	macOS Sonoma 14.5 \| HT214106 https://support.apple.com/en-us/HT214106
Patch	macOS Ventura 13.6.7 \| HT214107 https://support.apple.com/en-us/HT214107
Patch	macOS Monterey 12.7.5 \| HT214105 https://support.apple.com/en-us/HT214105
Patch	watchOS 10.5 \| HT214104 https://support.apple.com/en-us/HT214104
Patch	tvOS 17.5 \| HT214102 https://support.apple.com/en-us/HT214102
Patch	iOS 16.7.8 and iPadOS 16.7.8 \| HT214100 https://support.apple.com/en-us/HT214100

Definitive source of threat updates

https://support.apple.com/en-us/HT201222

CVE Vulnerabilities

Status Published

CVE-2024-27834

The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, Safari 17.5, watchOS 10.5, macOS Sonoma 14.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

Last edited: 11 June 2024 2:07 pm