CVE-2024-23243

CVE-2024-23243 is a privacy vulnerability in iOS and iPadOS that stems from inadequate redaction of sensitive location data in system log entries. Apple addressed the issue by improving private data redaction for logs [1].

An app running on an affected device could potentially read sensitive location information from log entries. The attack requires the app to have access to system logs, which may be possible without additional permissions in certain contexts. No user interaction is needed beyond installing a malicious or compromised app [1].

Successful exploitation could allow an app to infer the user's location, violating privacy. The CVSS score of 3.3 reflects the low severity, as the attack requires local access and the information leaked is limited to location data [1].

Apple released iOS 17.4 and iPadOS 17.4 on March 5, 2024, which contain the fix. Users are advised to update their devices to the latest version. The vulnerability affects iPhone XS and later, and various iPad models [1].