Technischer Bericht zum Apple iOS 17.5 und macOS Sonoma 14.5 Sicherheitsupdate bezüglich aktiv ausgenutzter WebKit- und Kernel-Schwachstellen.
CVE-2024-23222, an actively exploited type confusion vulnerability in the WebKit browser engine allowing remote attackers processing web content to bypass Pointer Authentication (PAC) and execute arbitrary code.
| CVE-Kennung | Subsystem / Komponente | Auswirkung | CVSS | Aktive Ausnutzung? |
|---|---|---|---|---|
CVE-2024-23222 | WebKit / JavaScriptCore | JIT Type Confusion | 8.8 High | YES (Targeted Spyware) |
CVE-2024-27834 | WebKit / Kernel IPC | Pointer Authentication Bypass | 7.8 High | YES (In-The-Wild) |
CVE-2024-27822 | AppleMobileFileIntegrity | Privilege Escalation | 6.7 Medium | No |
CVE-2024-27842 | Kernel Core | Memory Corruption | 7.8 High | No |
See the open-source C++ patch from github.com/WebKit/WebKit showing how Apple fixed DFG JIT object unboxing verification.