CVE-2024-54470
📋 TL;DR
This CVE describes a lock screen bypass vulnerability in Apple iOS and iPadOS that allows an attacker with physical access to view contacts without authentication. The vulnerability affects devices running vulnerable versions of iOS/iPadOS before the patched releases. This is a physical access attack requiring the attacker to have the device in hand.
💻 Affected Systems
- iPhone
- iPad
📦 What is this software?
Ipados by Apple
Ipados by Apple
⚠️ Risk & Real-World Impact
Worst Case
An attacker with physical access could view sensitive contact information including names, phone numbers, email addresses, and potentially other contact details stored on the device.
Likely Case
Opportunistic attackers (theft, lost device scenarios) could access personal contact information from a locked device, potentially enabling social engineering or privacy violations.
If Mitigated
With proper physical security controls and device encryption, the impact is limited to contact information exposure rather than full device compromise.
🎯 Exploit Status
Exploitation requires physical access to the device but no authentication or special tools. The vulnerability appears to be a logic flaw in lock screen handling.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: iOS 18.1, iPadOS 18.1, iOS 17.7.1, iPadOS 17.7.1
Vendor Advisory: https://support.apple.com/en-us/121563
Restart Required: Yes
Instructions:
1. Open Settings app. 2. Tap General. 3. Tap Software Update. 4. Download and install the available update. 5. Restart device when prompted.
🔧 Temporary Workarounds
Disable Lock Screen Contact Access
iosPrevent contacts from being accessible from the lock screen entirely
Settings > Face ID & Passcode (or Touch ID & Passcode) > Allow Access When Locked > Toggle off 'Today View and Search' and 'Return Missed Calls'
Enable Stricter Passcode Requirements
iosRequire passcode immediately and disable lock screen widgets
Settings > Face ID & Passcode > Require Passcode > Set to 'Immediately'
Settings > Face ID & Passcode > Allow Access When Locked > Disable all toggles
🧯 If You Can't Patch
- Implement strict physical security controls for mobile devices
- Enable Find My iPhone/iPad and remote wipe capabilities
🔍 How to Verify
Check if Vulnerable:
Check iOS/iPadOS version in Settings > General > About > Software Version. If version is earlier than iOS 18.1, iPadOS 18.1, iOS 17.7.1, or iPadOS 17.7.1, device is vulnerable.Check Version:
Settings > General > About > Software VersionVerify Fix Applied:
After updating, verify version shows iOS 18.1, iPadOS 18.1, iOS 17.7.1, or iPadOS 17.7.1 or later in Settings > General > About > Software Version.📡 Detection & Monitoring
Log Indicators:
- Unusual lock screen access patterns
- Multiple failed unlock attempts followed by successful contact access
Network Indicators:
- None - this is a local physical access vulnerability
SIEM Query:
Not applicable - local physical access attack