실제 악용된 WebKit 및 커널 취약점을 해결한 Apple iOS 17.5 및 macOS Sonoma 14.5 보안 릴리스에 대한 기술 분석.
CVE-2024-23222, an actively exploited type confusion vulnerability in the WebKit browser engine allowing remote attackers processing web content to bypass Pointer Authentication (PAC) and execute arbitrary code.
| CVE 식별자 | 서브시스템 / 구성 요소 | 영향 | CVSS | 실제 악용 여부? |
|---|---|---|---|---|
CVE-2024-23222 | WebKit / JavaScriptCore | JIT Type Confusion | 8.8 High | YES (Targeted Spyware) |
CVE-2024-27834 | WebKit / Kernel IPC | Pointer Authentication Bypass | 7.8 High | YES (In-The-Wild) |
CVE-2024-27822 | AppleMobileFileIntegrity | Privilege Escalation | 6.7 Medium | No |
CVE-2024-27842 | Kernel Core | Memory Corruption | 7.8 High | No |
See the open-source C++ patch from github.com/WebKit/WebKit showing how Apple fixed DFG JIT object unboxing verification.