Apple Pointer Authentication Bypass (CVE‑2024‑27834) Added to CISA KEV Catalog
What It Is — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has placed Apple’s CVE‑2024‑27834 in its Known Exploited Vulnerabilities (KEV) catalog. The flaw (CVSS 5.5) affects Safari, iOS 16.7.8/17.5, iPadOS 16.7.8/17.5, macOS Sonoma 14.5, tvOS 17.5 and watchOS 10.5. It allows an attacker who already possesses arbitrary read/write memory access to bypass Pointer Authentication (PAC), a hardware‑based cryptographic check that protects pointers from tampering. Bypassing PAC weakens Apple’s defense against memory‑corruption attacks and can enable further exploitation when chained with other vulnerabilities. Apple has released updated OS and Safari versions that add stricter security checks to mitigate the issue.
Affected Products — Apple Safari, iOS, iPadOS, macOS, tvOS, watchOS (versions listed above).
Why It Matters for Trust & Control Assurance — The vulnerability tests the control objective of memory‑integrity and execution‑flow protection; demonstrating that you have evidence of timely patching and verification of hardware‑based safeguards is essential for audit readiness.
Recommended Actions —
- Verify that all Apple devices in scope are running the patched versions listed above.
- Capture patch‑status evidence and map it to the “memory‑integrity protection” control in your framework of record.
- Incorporate continuous monitoring of firmware/OS updates into your endpoint‑hardening process.
Source: Security Affairs