CVE-2024-23203: Race Condition

Q: What is the severity of CVE-2024-23203?

CVE-2024-23203 is considered a significant vulnerability due to its potential to allow shortcuts to access sensitive data without user consent.

Q: How do I fix CVE-2024-23203?

To fix CVE-2024-23203, users should update their devices to iOS 17.3, iPadOS 17.3, or macOS Sonoma 14.3.

Q: Which devices are affected by CVE-2024-23203?

CVE-2024-23203 affects devices running iOS versions up to 17.2, iPadOS versions up to 17.2, and macOS versions up to 14.2.

Q: What type of vulnerability is CVE-2024-23203?

CVE-2024-23203 is a permissions-related vulnerability that allows actions without user prompting.

Q: Is there a workaround for CVE-2024-23203?

Currently, the best approach is to apply the update; no effective workaround is available for CVE-2024-23203.

Published Jan 22, 2024

Updated

Accessibility. This issue was addressed with additional entitlement checks.

Other sources

Admin Framework. A logic issue was addressed with improved checks.

— Apple

Airport. This issue was addressed with improved redaction of sensitive information.

— Apple

AppleMobileFileIntegrity. A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions.

— Apple

ColorSync. The issue was addressed with improved memory handling.

— Apple

CoreCrypto. A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions.

— Apple

Credit

an anonymous researcher, Jubaer Alnazi@@h33tjubaer, Clemens Lang, Joshua Jewett@@JoshJewett33, Junsung Lee(Trend Micro Zero Day Initiative), Amir Bazine(CrowdStrike Counter Adversary Operations), Karsten König(CrowdStrike Counter Adversary Operations), Dohyun Lee@@l33d0hyun, Lyutoon, Mr.R, Murray Mike, Pedro Tôrres@@t0rr3sp3dr0, Xinru Chi(Pangu Lab), CVE-2024-23225, Koh M. Nakagawa(FFRI Security Inc), Meng Zhang (鲸落)(NorthSea), Meysam Firouzi@@R00tkitsmm(Trend Micro Zero Day Initiative), CVE-2024-23283, Bohdan Stasiuk@@Bohdan_Stasiuk, Mickey Jin@@patch1t, Kirin@@Pwnrin, luckyu@@uuulucky, Csaba Fitzl@@theevilbit(Offensive Security), m4yfly with TianGong Team(Legendsec at Qi'anxin Group), Brian McNulty, CVE-2024-23235, Lyra Rebane (rebane2001), Lewis Hardy, Deutsche Telekom Security GmbH sponsored by Bundesamt für Sicherheit in der Informationstechnik, Georg Felber, Marco Squarcina, Johan Carlsson (joaxcar), Guilherme Rambo(Best Buddy Apps)

Affected Software

9 affected componentsFixes available

Apple macOS<14.3

14.3

macOS Ventura<13.6.5

13.6.5

Apple iOS and iPadOS<16.7.6

16.7.6

Apple iOS, iPadOS, and macOS<16.7.6

16.7.6

Apple iOS and iPadOS<17.3

17.3

Apple iOS, iPadOS, and macOS<17.3

17.3

Apple iOS, iPadOS, and macOS>17.0<17.3

iPhone OS>17.0<17.3

macOS<14.3

Event History

Jan 23, 2024

CVE Published

via MITRE·12:25 AM

Data Sourced

via MITRE·12:25 AM

DescriptionWeakness

Data Sourced

via NVD·01:15 AM

DescriptionSeverityAffected Software

Mar 7, 2024

Data Sourced

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Updated

via Apple·12:00 AM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-23203?

CVE-2024-23203 is considered a significant vulnerability due to its potential to allow shortcuts to access sensitive data without user consent.

How do I fix CVE-2024-23203?

To fix CVE-2024-23203, users should update their devices to iOS 17.3, iPadOS 17.3, or macOS Sonoma 14.3.

Which devices are affected by CVE-2024-23203?

CVE-2024-23203 affects devices running iOS versions up to 17.2, iPadOS versions up to 17.2, and macOS versions up to 14.2.

What type of vulnerability is CVE-2024-23203?

CVE-2024-23203 is a permissions-related vulnerability that allows actions without user prompting.

Is there a workaround for CVE-2024-23203?

Currently, the best approach is to apply the update; no effective workaround is available for CVE-2024-23203.

CVE-2024-23203: Race Condition

Other sources

Credit

Affected Software

Event History

Parent advisories

Peer vulnerabilities

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-23203?

How do I fix CVE-2024-23203?

Which devices are affected by CVE-2024-23203?

What type of vulnerability is CVE-2024-23203?

Is there a workaround for CVE-2024-23203?

Company

Resources

Contact