CVE-2024-40815
29.07.2024, 23:15
A race condition was addressed with additional validation. This issue is fixed in macOS Ventura 13.6.8, iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, macOS Sonoma 14.6. A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | 𝑥 < 17.6 |
| apple | iphone_os | 𝑥 < 17.6 |
| apple | macos | 𝑥 < 13.6.8 |
| apple | macos | 14.0 ≤ 𝑥 < 14.6 |
| apple | tvos | 𝑥 < 17.6 |
| apple | watchos | 𝑥 < 10.6 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
- CWE-352 - Cross-Site Request Forgery (CSRF)The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
References