CVE-2024-27816: Input Validation
Published May 13, 2024
·Updated
A logic issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker may be able to access user data.
Credit
Mickey Jin@@patch1t, an anonymous researcher, Ron Masas(Imperva), Kirin@@Pwnrin, 小来来@@Smi1eSEC, pattern-f@@pattern_F_(Ant Security Light), Amir Bazine(CrowdStrike Counter Adversary Operations), Karsten König(CrowdStrike Counter Adversary Operations), CertiK SkyFall Team, Junsung Lee(Trend Micro Zero Day Initiative), an anonymous researcher(MIT CSAIL), (MIT CSAIL), Joseph Ravichandran@@0xjprx(MIT CSAIL), Pr(Bar), Pr(Hebrew University), EP, Nick Wellnhofer, Gil Pedersen, Dohyun Lee@@l33d0hyun, LFY@@secsys(Fudan University), Daniel Zajork, Joshua Zajork, Meysam Firouzi@@R00tkitsmm(Trend Micro Zero Day Initiative), Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), Scott Johnson(RIPEDA Consulting), Mykola Grymalyuk(RIPEDA Consulting), Jordy Witteman, Carlos Polop, Pedro Tôrres@@t0rr3sp3dr0, Narendra Bhati(Suma Soft Pvt), Shaheen Fazim, Csaba Fitzl@@theevilbit(Kandji), LFY@@secsys, yulige, Snoolie Keffaber@@0xilis, Robert Reichel, CVE-2024-27806, Yann GASCUEL(Alter Solutions), ajajfxhj, Maksymilian Motyl(Immunity Systems), Manfred Paul@@_manfp(Trend Micro's Zero Day Initiative), Emilio Cobos(Mozilla), Lukas Bernhard(CISPA Helmholtz Center for Information Security), Nan Wang@@eternalsakura13(360 Vulnerability Research Institute), Joe Rutkowski@@Joe12387(Crawless), @@abrahamjuliot, Jeff Johnson(underpassapp), Pwn2car(Trend Micro's Zero Day Initiative), (Trend Micro's Zero Day Initiative), Michael DePlante@@izobashi(Trend Micro's Zero Day Initiative), Minghao Lin(Baidu Security), (Baidu Security), Ye Zhang@@VAR10CK(Baidu Security), Meysam Firouzi@@R00tkitSMM, Pan ZhenPeng@@Peterpan0927(STAR Labs SG Pte), Dalibor Milanovic, Manfred Paul@@_manfp(Trend Micro Zero Day Initiative), Adam Berry, Srijan Poudel, Abhay Kailasia@@abhay_kailasia(Lakshmi Narain College of Technology Bhopal), Romy R., Talal Haj Bakry(Mysk Inc), Tommy Mysk@@mysk_co(Mysk Inc), Andr.Ess, Lucas Monteiro, Daniel Monteiro, Felipe Monteiro, Alexander Heinrich, SEEMOO, TU Darmstadt@@Sn0wfreeze, Shai Mishali@@freak4pc
Affected Software
10 affected componentsFixes available
Apple macOS Sonoma<14.5
14.5
Apple tvOS<17.5
17.5
Apple WatchOS<10.5
10.5
Apple iOS<17.5
17.5
Apple iPadOS<17.5
17.5
Apple iPadOS<17.5
Apple iPhone OS<17.5
Apple macOS>=14.0<14.5
Apple tvOS<17.5
Apple WatchOS<10.5
Event History
May 13, 2024
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
DescriptionWeakness
May 14, 2024
Data Sourced
via NVD·03:13 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-27816?
CVE-2024-27816 is considered a high-severity vulnerability due to its potential for user data access.
2
How do I fix CVE-2024-27816?
To fix CVE-2024-27816, update affected devices to iOS 17.5, iPadOS 17.5, tvOS 17.5, watchOS 10.5, or macOS Sonoma 14.5.
3
What devices are affected by CVE-2024-27816?
CVE-2024-27816 affects devices running iOS, iPadOS, tvOS, watchOS, and macOS versions prior to the specified updates.
4
What type of issue is described in CVE-2024-27816?
CVE-2024-27816 describes a logic issue that could allow attackers to access user data.
5
When was CVE-2024-27816 addressed?
CVE-2024-27816 was addressed in the updates released for iOS 17.5 and related operating systems.