●Apple 보안 업데이트 · 2024년 5월

Apple 보안 업데이트: iOS 17.5 및 Safari WebKit

실제 악용된 WebKit 및 커널 취약점을 해결한 Apple iOS 17.5 및 macOS Sonoma 14.5 보안 릴리스에 대한 기술 분석.

2
In-The-Wild Zero-Days
8.8
CVSS WebKit Score
Safari
WebContent Sandbox Target
Priority
Mobile Fleet Action

보안 릴리스 분석 및 위험성 평가

Apple released security updates for iOS 17.5, iPadOS 17.5, and macOS Sonoma 14.5 fixing over 30 vulnerabilities. The focal point of the advisory is CVE-2024-23222, an actively exploited type confusion vulnerability in the WebKit browser engine allowing remote attackers processing web content to bypass Pointer Authentication (PAC) and execute arbitrary code.

핵심 취약점 트리아지 매트릭스

CVE 식별자 서브시스템 / 구성 요소 영향 CVSS 실제 악용 여부?
CVE-2024-23222WebKit / JavaScriptCoreJIT Type Confusion8.8 HighYES (Targeted Spyware)
CVE-2024-27834WebKit / Kernel IPCPointer Authentication Bypass7.8 HighYES (In-The-Wild)
CVE-2024-27822AppleMobileFileIntegrityPrivilege Escalation6.7 MediumNo
CVE-2024-27842Kernel CoreMemory Corruption7.8 HighNo
FEATURED CODE TEARDOWN

Deep Dive: CVE-2024-23222 Safari WebKit Object Unboxing Teardown →

See the open-source C++ patch from github.com/WebKit/WebKit showing how Apple fixed DFG JIT object unboxing verification.

← Browse Full Security Directory Explore All Source Teardowns →