CVE-2024-54501
📋 TL;DR
This vulnerability allows an attacker to cause a denial of service (DoS) by tricking a user into processing a maliciously crafted file on affected Apple devices. It affects multiple Apple operating systems including iOS, iPadOS, macOS, watchOS, tvOS, and visionOS. Users who process untrusted files on unpatched systems are at risk.
💻 Affected Systems
- iOS
- iPadOS
- macOS
- watchOS
- tvOS
- visionOS
📦 What is this software?
Ipados by Apple
Ipados by Apple
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Tvos by Apple
Watchos by Apple
⚠️ Risk & Real-World Impact
Worst Case
System crash or freeze requiring reboot, potentially disrupting device functionality and causing data loss in active applications.
Likely Case
Application crash or system instability when processing the malicious file, requiring user intervention to restore normal operation.
If Mitigated
No impact if patched; minimal disruption with proper file handling controls and user awareness.
🎯 Exploit Status
Exploitation requires user interaction to process a malicious file; no authentication bypass needed beyond file access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: iPadOS 17.7.3, watchOS 11.2, visionOS 2.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2
Vendor Advisory: https://support.apple.com/en-us/121837
Restart Required: Yes
Instructions:
1. Go to Settings > General > Software Update on iOS/iPadOS/watchOS/tvOS/visionOS. 2. Install the latest available update. 3. For macOS, go to System Settings > General > Software Update. 4. Install the appropriate security update for your macOS version. 5. Restart the device after installation.
🔧 Temporary Workarounds
Restrict file processing
allAvoid opening or processing files from untrusted sources to prevent exploitation.
🧯 If You Can't Patch
- Implement application whitelisting to restrict which applications can process files.
- Educate users about the risks of opening files from unknown or untrusted sources.
🔍 How to Verify
Check if Vulnerable:
Check the current OS version against the patched versions listed in the CVE description.Check Version:
iOS/iPadOS: Settings > General > About > Version. macOS: Apple menu > About This Mac > macOS version. watchOS: Watch app on iPhone > General > About > Version. tvOS: Settings > General > About > Version. visionOS: Settings > General > About > Software Version.Verify Fix Applied:
Verify the OS version matches or exceeds the patched versions after update installation.📡 Detection & Monitoring
Log Indicators:
- Application crash logs related to file processing
- System logs showing unexpected process termination
Network Indicators:
- Unusual file downloads from untrusted sources if monitored
SIEM Query:
Search for application crash events with file-related processes on Apple devices.🔗 References
- https://support.apple.com/en-us/121837
- https://support.apple.com/en-us/121838
- https://support.apple.com/en-us/121839
- https://support.apple.com/en-us/121840
- https://support.apple.com/en-us/121842
- https://support.apple.com/en-us/121843
- https://support.apple.com/en-us/121844
- https://support.apple.com/en-us/121845
- http://seclists.org/fulldisclosure/2024/Dec/10
- http://seclists.org/fulldisclosure/2024/Dec/12
- http://seclists.org/fulldisclosure/2024/Dec/6
- http://seclists.org/fulldisclosure/2024/Dec/7
- http://seclists.org/fulldisclosure/2024/Dec/9
