CVE-2024-27826

The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6.8, macOS Sonoma 14.5, macOS Monterey 12.7.6, watchOS 10.5, visionOS 1.3, tvOS 17.5, iOS 17.5 and iPadOS 17.5. An app may be able to execute arbitrary code with kernel privileges.

Weakness

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Potential Mitigations

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/122.html
• https://cwe.mitre.org/data/definitions/233.html
• https://cwe.mitre.org/data/definitions/58.html

References

• http://seclists.org/fulldisclosure/2024/Jul/19
• http://seclists.org/fulldisclosure/2024/Jul/20
• http://seclists.org/fulldisclosure/2024/Jul/23
• https://support.apple.com/en-us/HT214101
• https://support.apple.com/en-us/HT214102
• https://support.apple.com/en-us/HT214104
• https://support.apple.com/en-us/HT214106
• https://support.apple.com/en-us/HT214118
• https://support.apple.com/en-us/HT214120
• https://support.apple.com/en-us/HT214123
• https://support.apple.com/kb/HT214101
• https://support.apple.com/kb/HT214102
• https://support.apple.com/kb/HT214104
• https://support.apple.com/kb/HT214106