CVE-2024-44204
📋 TL;DR
This vulnerability allows VoiceOver, Apple's screen reader accessibility feature, to audibly read saved passwords from the keychain on unpatched iOS/iPadOS devices. It affects users who have saved passwords in their device's keychain and use VoiceOver functionality. The issue requires physical access or screen sharing to exploit.
💻 Affected Systems
- iPhone
- iPad
📦 What is this software?
Ipados by Apple
⚠️ Risk & Real-World Impact
Worst Case
An attacker with physical access or screen sharing capability could have VoiceOver read sensitive passwords aloud, potentially compromising accounts protected by those credentials.
Likely Case
Accidental exposure when VoiceOver is enabled during password viewing, or targeted exploitation by someone with brief physical access to the device.
If Mitigated
Minimal impact if device is kept secure, VoiceOver is disabled when not needed, and strong authentication protects device access.
🎯 Exploit Status
Exploitation requires physical device access or screen sharing capability. Simple to execute once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: iOS 18.0.1, iPadOS 18.0.1
Vendor Advisory: https://support.apple.com/en-us/121373
Restart Required: Yes
Instructions:
1. Open Settings app. 2. Go to General > Software Update. 3. Download and install iOS/iPadOS 18.0.1. 4. Device will restart automatically.
🔧 Temporary Workarounds
Disable VoiceOver
allTurn off VoiceOver accessibility feature when not actively using it
Settings > Accessibility > VoiceOver > Toggle OFF
Use Guided Access
allEnable Guided Access to restrict device to single app and disable VoiceOver
Settings > Accessibility > Guided Access > Toggle ON
🧯 If You Can't Patch
- Disable VoiceOver accessibility feature when not in use
- Implement strict physical security controls for devices
🔍 How to Verify
Check if Vulnerable:
Check iOS/iPadOS version in Settings > General > About > Software Version. If version is below 18.0.1, device is vulnerable.Check Version:
Settings > General > About > Software VersionVerify Fix Applied:
Confirm iOS/iPadOS version is 18.0.1 or later in Settings > General > About > Software Version.📡 Detection & Monitoring
Log Indicators:
- VoiceOver activation logs
- Accessibility service usage patterns
Network Indicators:
- None - local exploitation only
SIEM Query:
device.os.version < "18.0.1" AND device.type IN ("iphone", "ipad")