CVE-2024-54510
📋 TL;DR
A race condition vulnerability in Apple operating systems could allow malicious apps to leak sensitive kernel state information. This affects multiple Apple devices including iPhones, iPads, Macs, Apple Watches, and Apple TVs. The vulnerability has been addressed in recent security updates.
💻 Affected Systems
- iPhone
- iPad
- Mac
- Apple Watch
- Apple TV
📦 What is this software?
Ipados by Apple
Ipados by Apple
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Tvos by Apple
Watchos by Apple
⚠️ Risk & Real-World Impact
Worst Case
An attacker could gain access to sensitive kernel memory contents, potentially leading to privilege escalation or information disclosure about system internals.
Likely Case
Malicious apps could leak kernel state information, potentially enabling further exploitation or information gathering about the device.
If Mitigated
With proper app sandboxing and security controls, exploitation would be limited to information disclosure within the app's context.
🎯 Exploit Status
Exploitation requires a malicious app to be installed and race condition timing to be successfully triggered.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: iPadOS 17.7.3, watchOS 11.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2
Vendor Advisory: https://support.apple.com/en-us/121837
Restart Required: Yes
Instructions:
1. Go to Settings > General > Software Update on iOS/iPadOS/watchOS/tvOS. 2. Go to System Settings > General > Software Update on macOS. 3. Download and install the latest available update. 4. Restart the device when prompted.
🔧 Temporary Workarounds
Restrict App Installation
allOnly install apps from trusted sources like the official App Store to reduce risk of malicious apps.
🧯 If You Can't Patch
- Implement strict app installation policies to prevent untrusted apps from being installed
- Monitor for unusual app behavior and consider app whitelisting
🔍 How to Verify
Check if Vulnerable:
Check current OS version against affected versions list. On iOS/iPadOS: Settings > General > About > Version. On macOS: Apple menu > About This Mac > macOS version.Check Version:
iOS/iPadOS/watchOS/tvOS: No command line, use Settings app. macOS: sw_vers -productVersionVerify Fix Applied:
Verify OS version matches or exceeds patched versions listed in fix_official.patch_version.📡 Detection & Monitoring
Log Indicators:
- Unusual kernel memory access patterns
- App crash reports involving kernel space
Network Indicators:
- No direct network indicators - local exploitation only
SIEM Query:
No specific SIEM query - monitor for app installation events and kernel panic logs🔗 References
- https://support.apple.com/en-us/121837
- https://support.apple.com/en-us/121838
- https://support.apple.com/en-us/121839
- https://support.apple.com/en-us/121840
- https://support.apple.com/en-us/121842
- https://support.apple.com/en-us/121843
- https://support.apple.com/en-us/121844
- http://seclists.org/fulldisclosure/2024/Dec/11
- http://seclists.org/fulldisclosure/2024/Dec/5
- http://seclists.org/fulldisclosure/2024/Dec/6
- http://seclists.org/fulldisclosure/2024/Dec/7
- http://seclists.org/fulldisclosure/2024/Dec/9
