CVE-2024-40815

moderate-risk
Published 2024-07-29

A race condition was addressed with additional validation. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, tvOS 17.6, watchOS 10.6. A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

Do I need to act?

~
7.2% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / HIGH complexity

Affected Products (5)

Affected Vendors

Apple

References (20)

https://support.apple.com/en-us/120909
https://support.apple.com/en-us/120911
https://support.apple.com/en-us/120912
https://support.apple.com/en-us/120914
https://support.apple.com/en-us/120916
Mailing List http://seclists.org/fulldisclosure/2024/Jul/16
Mailing List http://seclists.org/fulldisclosure/2024/Jul/18
Mailing List http://seclists.org/fulldisclosure/2024/Jul/19
Mailing List http://seclists.org/fulldisclosure/2024/Jul/21
Mailing List http://seclists.org/fulldisclosure/2024/Jul/22
Release Notes https://support.apple.com/en-us/HT214117
Release Notes https://support.apple.com/en-us/HT214119
Release Notes https://support.apple.com/en-us/HT214120
Release Notes https://support.apple.com/en-us/HT214122
Release Notes https://support.apple.com/en-us/HT214124
https://support.apple.com/kb/HT214117
https://support.apple.com/kb/HT214119
https://support.apple.com/kb/HT214120
https://support.apple.com/kb/HT214122
https://support.apple.com/kb/HT214124
43
/ 100
moderate-risk
Severity 22/34 · High
Exploitability 9/34 · Low
Exposure 12/34 · Low