CVE-2024-40813: Input Validation

Q: What is the severity of CVE-2024-40813?

CVE-2024-40813 has been classified as a medium severity vulnerability due to its potential for unauthorized access to sensitive user data.

Q: How do I fix CVE-2024-40813?

To fix CVE-2024-40813, users should update their devices to watchOS 10.6, iOS 17.6, or iPadOS 17.6.

Q: Who is affected by CVE-2024-40813?

CVE-2024-40813 affects users of Apple watchOS versions prior to 10.6 and iOS/iPadOS versions prior to 17.6.

Q: What type of vulnerability is CVE-2024-40813?

CVE-2024-40813 is a lock screen vulnerability that could allow an attacker with physical access to exploit Siri to access sensitive user data.

Q: When was CVE-2024-40813 addressed?

CVE-2024-40813 was addressed with improvements in state management and fixed in updates released on July 16, 2024.

Published Jul 29, 2024

Updated

A lock screen issue was addressed with improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, watchOS 10.6. An attacker with physical access may be able to use Siri to access sensitive user data.

Other sources

AirDrop. This issue was addressed through improved state management.

— Apple

AppleMobileFileIntegrity. A downgrade issue was addressed with additional code-signing restrictions.

— Apple

CoreGraphics. An out-of-bounds read issue was addressed with improved input validation.

— Apple

CoreMedia. An out-of-bounds write issue was addressed with improved input validation.

— Apple

dyld. A race condition was addressed with additional validation.

— Apple

Credit

Jacob Braun, Mickey Jin@@patch1t, D4m0n, w0wbox, Csaba Fitzl@@theevilbit(Kandji), CVE-2023-6277, CVE-2023-52356, Yisumi, Junsung Lee(Trend Micro Zero Day Initiative), Amir Bazine(CrowdStrike Counter Adversary Operations), Karsten König(CrowdStrike Counter Adversary Operations), Gandalf4a, CertiK SkyFall Team, Minghao Lin(Zhejiang University), Jiaxun Zhu(Zhejiang University), CVE-2024-40805, Wojciech Regula(SecuRing), Zhongquan Li@@Guluisacat(Dawn Security Lab of JingDong), an anonymous researcher, Kirin@@Pwnrin, Bistrit Dahal, Srijan Poudel, Abhay Kailasia@@abhay_kailasia(Lakshmi Narain College of Technology Bhopal India), ajajfxhj, Huang Xilin(Ant Group Light), Maksymilian Motyl, Johan Carlsson (joaxcar), Seunghyun Lee@@0x10n(KAIST Hacking Lab working with Trend Micro Zero Day Initiative), Gary Kwong, Andreas Jaegersberger, Ro Achterberg, Linwz(DEVCORE), (CrowdStrike Counter Adversary Operations), Mateen Alinaghi, (Dawn Security Lab of JingDong), Mickey Jin@@patch1t(Kandji), Jiahui Hu (梅零落)(NorthSea), Meng Zhang (鲸落)(NorthSea), Matthew Butler, CVE-2024-4558

Affected Software

6 affected componentsFixes available

Apple WatchOS<10.6

10.6

Apple iOS<17.6

17.6

Apple iPadOS<17.6

17.6

Apple iPadOS<17.6

Apple iPhone OS<17.6

Apple WatchOS<10.6

Event History

Jul 29, 2024

Data Sourced

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Updated

via Apple·12:00 AM

DescriptionWeakness

Updated

via Apple·12:00 AM

Description

Updated

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Updated

via Apple·12:00 AM

Affected Software

Updated

via Apple·12:00 AM

DescriptionAffected Software

CVE Published

via MITRE·10:17 PM

Data Sourced

via MITRE·10:17 PM

DescriptionWeakness

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2024-40813?

CVE-2024-40813 has been classified as a medium severity vulnerability due to its potential for unauthorized access to sensitive user data.

How do I fix CVE-2024-40813?

To fix CVE-2024-40813, users should update their devices to watchOS 10.6, iOS 17.6, or iPadOS 17.6.

Who is affected by CVE-2024-40813?

CVE-2024-40813 affects users of Apple watchOS versions prior to 10.6 and iOS/iPadOS versions prior to 17.6.

What type of vulnerability is CVE-2024-40813?

CVE-2024-40813 is a lock screen vulnerability that could allow an attacker with physical access to exploit Siri to access sensitive user data.

When was CVE-2024-40813 addressed?

CVE-2024-40813 was addressed with improvements in state management and fixed in updates released on July 16, 2024.

CVE-2024-40813: Input Validation

Other sources

Credit

Affected Software

Event History

Parent advisories

Peer vulnerabilities

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-40813?

How do I fix CVE-2024-40813?

Who is affected by CVE-2024-40813?

What type of vulnerability is CVE-2024-40813?

When was CVE-2024-40813 addressed?

Company

Resources

Contact