CVE-2024-40854

Vulnerability

Overview

CVE-2024-40854 is a memory initialization issue affecting Apple operating systems, including iOS, iPadOS, and macOS. The vulnerability exists due to improper memory handling, which could allow an application to trigger unexpected system termination. Apple addressed the issue by improving memory handling in software updates released on October 28, 2024 [1][2][3][4].

Exploitation

Vector

The attack surface for this vulnerability requires a malicious or compromised app to be installed on the device. No physical access or advanced network position is necessary beyond the ability to run code on the system. The vulnerability is triggered through normal app execution, exploiting the memory initialization flaw to cause a system crash [1].

Impact

Successful exploitation leads to unexpected system termination, effectively causing a denial of service (DoS) condition. This can disrupt device operation, potentially leading to data loss or service unavailability. The CVSS v3 score of 5.5 (Medium) reflects the local attack vector and the requirement for an app to be installed, but the impact is limited to availability [1].

Mitigation

The vulnerability is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, and macOS Ventura 13.7.1. Users are advised to update their devices to the latest available versions. Apple does not provide a workaround, and the issue is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1].