CVE-2024-40771
Published May 13, 2024
·Updated
Apple Neural Engine. The issue was addressed with improved memory handling.
Credit
Minghao Lin(Baidu Security), (Baidu Security), Ye Zhang@@VAR10CK(Baidu Security), Meysam Firouzi@@R00tkitSMM, Mickey Jin@@patch1t, an anonymous researcher, Kirin@@Pwnrin, 小来来@@Smi1eSEC, pattern-f@@pattern_F_(Ant Security Light), Amir Bazine(CrowdStrike Counter Adversary Operations), Karsten König(CrowdStrike Counter Adversary Operations), Lucas Monteiro, Daniel Monteiro, Felipe Monteiro, Alexander Heinrich, SEEMOO, TU Darmstadt@@Sn0wfreeze, Shai Mishali@@freak4pc, CertiK SkyFall Team, Junsung Lee(Trend Micro Zero Day Initiative), Pan ZhenPeng@@Peterpan0927(STAR Labs SG Pte), an anonymous researcher(MIT CSAIL), (MIT CSAIL), Joseph Ravichandran@@0xjprx(MIT CSAIL), Pr(Bar), Pr(Hebrew University), EP, Nick Wellnhofer, Gil Pedersen, Dohyun Lee@@l33d0hyun, LFY@@secsys(Fudan University), Talal Haj Bakry(Mysk Inc), Tommy Mysk@@mysk_co(Mysk Inc), Daniel Zajork, Joshua Zajork, Meysam Firouzi@@R00tkitsmm(Trend Micro Zero Day Initiative), Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), Andr.Ess, Adam Berry, Csaba Fitzl@@theevilbit(Kandji), LFY@@secsys, yulige, Snoolie Keffaber@@0xilis, Robert Reichel, Srijan Poudel, CVE-2024-27806, Abhay Kailasia@@abhay_kailasia(Lakshmi Narain College of Technology Bhopal), Romy R., ajajfxhj, Maksymilian Motyl(Immunity Systems), Manfred Paul@@_manfp(Trend Micro's Zero Day Initiative), Emilio Cobos(Mozilla), Lukas Bernhard(CISPA Helmholtz Center for Information Security), Manfred Paul@@_manfp(Trend Micro Zero Day Initiative), Nan Wang@@eternalsakura13(360 Vulnerability Research Institute), Joe Rutkowski@@Joe12387(Crawless), @@abrahamjuliot, Jeff Johnson(underpassapp), Dalibor Milanovic, an anonymous researcher(Concentrix), 凯 王(Concentrix), Steven Maser(Concentrix), Matthew McLean(Concentrix), Brandon Chesser(Concentrix), CPU IT inc(Concentrix), (Concentrix), Avalon IT Team(Concentrix), Pedro Tôrres@@t0rr3sp3dr0, CVE-2024-23296, Yann GASCUEL(Alter Solutions), Joshua Jewett@@JoshJewett33, Ron Masas(Imperva), Scott Johnson(RIPEDA Consulting), Mykola Grymalyuk(RIPEDA Consulting), Jordy Witteman, Carlos Polop, Narendra Bhati(Suma Soft Pvt), Shaheen Fazim, Pwn2car(Trend Micro's Zero Day Initiative), (Trend Micro's Zero Day Initiative), Michael DePlante@@izobashi(Trend Micro's Zero Day Initiative), Ryan Pickren (ryanpickren.com)
Affected Software
28 affected componentsFixes available
Apple tvOS<17.5
17.5
Apple WatchOS<10.5
10.5
Apple visionOS<1.2
1.2
Apple macOS Monterey<12.7.5
12.7.5
Apple macOS Sonoma<14.5
14.5
Apple macOS Sonoma
Apple iOS
Apple iPadOS
Apple macOS Monterey
Apple WatchOS
Apple tvOS
Apple macOS Ventura
Apple visionOS
Apple iOS<16.7.8
16.7.8
Apple iPadOS<16.7.8
16.7.8
Apple iOS<17.5
17.5
Apple iPadOS<17.5
17.5
Apple iPadOS<16.7.8
Apple iPadOS>=17.0<17.5
Apple iPhone OS<16.7.8
Apple iPhone OS>=17.0<17.5
Apple macOS<13.6.7
Apple macOS>=12.0<12.7.5
Apple macOS>=13.0<13.6.7
Apple macOS>=14.0<14.5
Apple tvOS<17.5
Apple visionOS<1.2
Apple macOS Ventura<13.6.7
13.6.7
Event History
May 13, 2024
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Jun 10, 2024
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Jan 15, 2025
CVE Published
via MITRE·07:35 PM
Data Sourced
via MITRE·07:35 PM
DescriptionWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-40771?
CVE-2024-40771 is considered a high severity vulnerability due to its potential to allow arbitrary code execution with kernel privileges.
2
How do I fix CVE-2024-40771?
To fix CVE-2024-40771, you should update your device to the latest versions of macOS Sonoma, iOS, iPadOS, macOS Monterey, watchOS, tvOS, macOS Ventura, or visionOS as appropriate.
3
Which operating systems are affected by CVE-2024-40771?
CVE-2024-40771 affects various versions of Apple operating systems, including macOS Sonoma, iOS, iPadOS, macOS Monterey, watchOS, tvOS, macOS Ventura, and visionOS.
4
What type of attack does CVE-2024-40771 enable?
CVE-2024-40771 enables an attacker to execute arbitrary code with kernel privileges, which can lead to serious security breaches.
5
When was CVE-2024-40771 reported?
CVE-2024-40771 was reported alongside the release of patches for affected Apple operating systems in the update cycle for 2024.