Vulnerabilities > CVE-2024-23296 - Out-of-bounds Write vulnerability in Apple products
Attack vector
LOCAL Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 17.4 and iPadOS 17.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Related news
- Urgent: Apple Issues Critical Updates for Actively Exploited Zero-Day Flaws (source)
- Apple backports fix for RTKit iOS zero-day to older iPhones (source)
- Apple backports iOS zero-day patch, adds Bluetooth tracker alert (source)
- Apple backports fix for zero-day exploited in attacks to older iPhones (source)
References
- https://support.apple.com/en-us/HT214081
- https://support.apple.com/kb/HT214088
- https://support.apple.com/kb/HT214084
- https://support.apple.com/kb/HT214086
- https://support.apple.com/kb/HT214087
- http://seclists.org/fulldisclosure/2024/Mar/18
- http://seclists.org/fulldisclosure/2024/Mar/21
- http://seclists.org/fulldisclosure/2024/Mar/25
- http://seclists.org/fulldisclosure/2024/Mar/24
- http://seclists.org/fulldisclosure/2024/Mar/26
- https://support.apple.com/kb/HT214107
- http://seclists.org/fulldisclosure/2024/May/11
- http://seclists.org/fulldisclosure/2024/May/13
- https://support.apple.com/kb/HT214100
- https://support.apple.com/kb/HT214118
- http://seclists.org/fulldisclosure/2024/Jul/20