CVE-2024-44278

Vulnerability

Overview CVE-2024-44278 is an information disclosure issue in Apple's operating systems. The root cause is inadequate private data redaction in log entries, allowing system logs to contain sensitive user information that should have been masked. This flaw affects iOS, iPadOS, macOS, visionOS, and watchOS versions prior to the patches released on October 28, 2024 [1][2][3][4].

Exploitation

An attacker can exploit this vulnerability by running a sandboxed app on the affected device. The app does not require elevated privileges; being sandboxed is sufficient to read system logs and extract the unredacted sensitive data. No user interaction or network access is needed, making it a local attack vector with low complexity [1].

Impact

Successful exploitation allows a malicious app to access sensitive user data that was inadvertently written to system logs. This could include personal information such as contact details, location data, or other private information, depending on what data was logged. The confidentiality impact is high, while integrity and availability are not affected, as per the CVSS score of 5.5 (Medium).

Mitigation

Apple addressed this issue by improving private data redaction in log entries. The fix is included in the following updates: iOS 17.7.1 and 18.1, iPadOS 17.7.1 and 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, visionOS 2.1, and watchOS 11.1 [1][2][3][4]. Users should install these updates to protect their devices. There are no known workarounds; applying the patches is the recommended course of action.