CVE-2024-44180

Vulnerability

The vulnerability is a lock screen bypass issue that allows an attacker with physical access to access contacts from the lock screen. The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, released on September 16, 2024. The affected devices include iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later [1].

Exploitation

An attacker must have physical access to the locked device. The specific steps to trigger the vulnerability are not disclosed in the available references, but the issue occurs from the lock screen, implying the attacker can bypass normal lock screen protections without authentication [1].

Impact

On successful exploitation, an attacker can access contacts stored on the device without unlocking it, leading to information disclosure of contact data from the lock screen [1].

Mitigation

The vulnerability is fixed in iOS 18 and iPadOS 18, which were released on September 16, 2024. Users should update their devices to the latest operating system version to mitigate the issue [1].