CVE-2024-27836: Input Validation
Published May 13, 2024
·Updated
Apple Neural Engine. The issue was addressed with improved memory handling.
Credit
Junsung Lee(Trend Micro Zero Day Initiative), Minghao Lin(Baidu Security), (Baidu Security), Ye Zhang@@VAR10CK(Baidu Security), Meysam Firouzi@@R00tkitSMM, Mickey Jin@@patch1t, an anonymous researcher, Kirin@@Pwnrin, 小来来@@Smi1eSEC, pattern-f@@pattern_F_(Ant Security Light), Amir Bazine(CrowdStrike Counter Adversary Operations), Karsten König(CrowdStrike Counter Adversary Operations), Lucas Monteiro, Daniel Monteiro, Felipe Monteiro, Alexander Heinrich, SEEMOO, TU Darmstadt@@Sn0wfreeze, Shai Mishali@@freak4pc, CertiK SkyFall Team, Pan ZhenPeng@@Peterpan0927(STAR Labs SG Pte), an anonymous researcher(MIT CSAIL), (MIT CSAIL), Joseph Ravichandran@@0xjprx(MIT CSAIL), Pr(Bar), Pr(Hebrew University), EP, Nick Wellnhofer, Gil Pedersen, Dohyun Lee@@l33d0hyun, LFY@@secsys(Fudan University), Talal Haj Bakry(Mysk Inc), Tommy Mysk@@mysk_co(Mysk Inc), Daniel Zajork, Joshua Zajork, Meysam Firouzi@@R00tkitsmm(Trend Micro Zero Day Initiative), Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), Andr.Ess, Adam Berry, Csaba Fitzl@@theevilbit(Kandji), LFY@@secsys, yulige, Snoolie Keffaber@@0xilis, Robert Reichel, Srijan Poudel, CVE-2024-27806, Abhay Kailasia@@abhay_kailasia(Lakshmi Narain College of Technology Bhopal), Romy R., ajajfxhj, Maksymilian Motyl(Immunity Systems), Manfred Paul@@_manfp(Trend Micro's Zero Day Initiative), Emilio Cobos(Mozilla), Lukas Bernhard(CISPA Helmholtz Center for Information Security), Manfred Paul@@_manfp(Trend Micro Zero Day Initiative), Nan Wang@@eternalsakura13(360 Vulnerability Research Institute), Joe Rutkowski@@Joe12387(Crawless), @@abrahamjuliot, Jeff Johnson(underpassapp), Ron Masas(Imperva), Scott Johnson(RIPEDA Consulting), Mykola Grymalyuk(RIPEDA Consulting), Jordy Witteman, Carlos Polop, Pedro Tôrres@@t0rr3sp3dr0, Narendra Bhati(Suma Soft Pvt), Shaheen Fazim, Yann GASCUEL(Alter Solutions), Ryan Pickren (ryanpickren.com), Pwn2car(Trend Micro's Zero Day Initiative), (Trend Micro's Zero Day Initiative), Michael DePlante@@izobashi(Trend Micro's Zero Day Initiative)
Affected Software
8 affected componentsFixes available
Apple macOS<14.5
14.5
Apple visionOS<1.2
1.2
Apple iOS and iPadOS<17.5
17.5
Apple iOS, iPadOS, and macOS<17.5
17.5
Apple iOS, iPadOS, and macOS<17.5
iPhone OS<17.5
macOS<14.5
Apple visionOS<1.2
Event History
May 13, 2024
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
Jun 10, 2024
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
CVE Published
via MITRE·08:56 PM
Data Sourced
via MITRE·08:56 PM
DescriptionWeakness
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-27836?
CVE-2024-27836 is classified as a high severity vulnerability due to its potential impact on memory handling.
2
How do I fix CVE-2024-27836?
To fix CVE-2024-27836, update the affected Apple products to the recommended versions: iOS and iPadOS 17.5, and macOS Sonoma 14.5.
3
Which Apple products are affected by CVE-2024-27836?
CVE-2024-27836 affects iOS up to version 17.5, iPadOS up to version 17.5, and macOS up to version 14.5.
4
What issues does CVE-2024-27836 address in Apple's software?
CVE-2024-27836 addresses memory handling issues and downgrade vulnerabilities affecting Intel-based Mac computers.
5
Is CVE-2024-27836 specific to a particular version of Apple's software?
Yes, CVE-2024-27836 is specific to versions of iOS and iPadOS prior to 17.5 and macOS prior to 14.5.