CVE-2024-40815: A race condition was addressed with additional validation

Description

A race condition was addressed with additional validation. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, tvOS 17.6, watchOS 10.6. A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

High

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.1% · higher than 65% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

MA

macOS · Apple

before 13.6.8; before 14.6 · source: vendor, NVD, CISA

IO

iOS · Apple

before 17.6 · source: NVD, CISA

IA

iOS and iPadOS · Apple

before 17.6 · source: vendor

TV

tvOS · Apple

before 17.6 · source: vendor, NVD, CISA

WA

watchOS · Apple

before 10.6 · source: vendor, NVD, CISA

IO

Ipad OS · Apple

before 17.6 · source: CISA