CVE-2024-40796
📋 TL;DR
This CVE describes a privacy vulnerability in Apple operating systems where private browsing history may leak into system logs. The issue affects users of macOS, iOS, and iPadOS who use private browsing mode. Attackers with access to system logs could potentially view browsing history that should remain private.
💻 Affected Systems
- macOS
- iOS
- iPadOS
📦 What is this software?
Ipados by Apple
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →⚠️ Risk & Real-World Impact
Worst Case
An attacker with local access or malware could extract private browsing history from system logs, compromising user privacy and potentially revealing sensitive information about browsing habits.
Likely Case
Local users or applications with log access could inadvertently or intentionally view private browsing data that should have been redacted from logs.
If Mitigated
With proper access controls limiting log access to authorized administrators only, the impact is reduced to trusted personnel potentially viewing private browsing data.
🎯 Exploit Status
Exploitation requires access to system logs, which typically requires local access or compromised system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: macOS Sonoma 14.6, iOS 16.7.9, iPadOS 16.7.9, macOS Monterey 12.7.6, macOS Ventura 13.6.8
Vendor Advisory: https://support.apple.com/en-us/HT214116
Restart Required: Yes
Instructions:
1. Open System Settings > General > Software Update. 2. Install the available update. 3. Restart the device when prompted.
🔧 Temporary Workarounds
Restrict log access
macOSLimit access to system logs to authorized administrators only to prevent unauthorized viewing of potentially leaked private browsing data.
sudo chmod 640 /var/log/*.log
sudo chown root:admin /var/log/*.log
Clear system logs regularly
macOSRegularly clear system logs to remove any potentially leaked private browsing data.
sudo rm /var/log/*.log
sudo log erase --all
🧯 If You Can't Patch
- Avoid using private browsing mode on affected systems until patched
- Implement strict access controls on system logs and monitor for unauthorized access
🔍 How to Verify
Check if Vulnerable:
Check system version: On macOS, go to Apple menu > About This Mac. On iOS/iPadOS, go to Settings > General > About.Check Version:
macOS: sw_vers -productVersion, iOS/iPadOS: Not available via command line, check in SettingsVerify Fix Applied:
Verify system version is equal to or newer than the patched versions listed in the fix information.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to system log files
- Log entries containing browsing-related data during private browsing sessions
Network Indicators:
- None - this is a local information disclosure vulnerability
SIEM Query:
source="*/var/log/*.log" AND (event_description="browsing" OR event_description="history") AND user="*"🔗 References
- http://seclists.org/fulldisclosure/2024/Jul/17
- http://seclists.org/fulldisclosure/2024/Jul/18
- http://seclists.org/fulldisclosure/2024/Jul/19
- http://seclists.org/fulldisclosure/2024/Jul/20
- https://support.apple.com/en-us/HT214116
- https://support.apple.com/en-us/HT214118
- https://support.apple.com/en-us/HT214119
- https://support.apple.com/en-us/HT214120
- http://seclists.org/fulldisclosure/2024/Jul/17
- http://seclists.org/fulldisclosure/2024/Jul/18
- http://seclists.org/fulldisclosure/2024/Jul/19
- http://seclists.org/fulldisclosure/2024/Jul/20
- https://support.apple.com/en-us/HT214116
- https://support.apple.com/en-us/HT214118
- https://support.apple.com/en-us/HT214119
- https://support.apple.com/en-us/HT214120
- https://support.apple.com/kb/HT214116
- https://support.apple.com/kb/HT214118
- https://support.apple.com/kb/HT214119
- https://support.apple.com/kb/HT214120
