First published: Mon Oct 28 2024(Updated: )
A logic issue was addressed with improved file handling. This issue is fixed in iOS 18.1 and iPadOS 18.1, iOS 17.7.1 and iPadOS 17.7.1, visionOS 2.1, tvOS 18.1. Restoring a maliciously crafted backup file may lead to modification of protected system files.
Credit: Rizki Maulana (rmrizki.my.id) Matthew Butler Jake Derouin an anonymous researcher Ivan Fratric Google Project ZeroK宝 @Pwnrin pattern-f @pattern_F_ Loadshine LabHikerell Loadshine LabHossein Lotfi @hosselot Trend Micro Zero Day InitiativeWang Yu CyberservalJunsung Lee Trend Micro Zero Day InitiativeJex Amro Ye Zhang @VAR10CK Baidu SecurityZiyi Zhou Jiao Tong University) @Shanghai Tianxiao Hou Jiao Tong University) @Shanghai Mateusz Krzywicki @krzywix Ben Roeder Hichem Maloufi Christian Mina Ismail Amzdak Nimrat Khalsa Davis Dai James Gill @infosec.exchange) @jjtech an anonymous researcher Dawn Security Lab of JDYinyi Wu @_3ndy1 Dawn Security Lab of JDNarendra Bhati Cyber Security at Suma Soft PvtManager Cyber Security at Suma Soft PvtPune (India) Lucas Di Tomase Michael DePlante @izobashi Trend Micro Zero Day InitiativeBing Shi Alibaba GroupWenchao Li Alibaba GroupXiaolong Bai Alibaba Group Indiana University BloomingtonLuyi Xing Indiana University BloomingtonKirin @Pwnrin Bistrit Dahal Kenneth Chew Rodolphe Brunetti @eisw0lf Abhay Kailasia @abhay_kailasia Lakshmi Narain College of Technology Bhopal IndiaSrijan Poudel 7feilee Cristian Dinca (icmd.tech) Dalibor Milanovic Richard Hyunho Im with Route Zero Security @richeeta Braylon @softwarescool Wojciech Regula SecuRingQ1IQ @q1iqF P1umer @p1umer 냥냥 Justin Saboo product-security@apple.com
Affected Software | Affected Version | How to fix |
---|---|---|
tvOS | <18.1 | 18.1 |
visionOS | <2.1 | 2.1 |
Apple iOS and iPadOS | <18.1 | 18.1 |
Apple iOS, iPadOS, and macOS | <18.1 | 18.1 |
Apple iOS and iPadOS | <17.7.1 | 17.7.1 |
Apple iOS, iPadOS, and macOS | <17.7.1 | 17.7.1 |
Apple iOS, iPadOS, and macOS | <17.7.1 | |
Apple iOS, iPadOS, and macOS | >=18.0<18.1 | |
iPhone OS | <17.7.1 | |
iPhone OS | >=18.0<18.1 | |
tvOS | <18.1 | |
visionOS | <2.1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
(Found alongside the following vulnerabilities)
CVE-2024-44252 is classified as a critical vulnerability due to its potential to allow modification of protected system files.
To fix CVE-2024-44252, update your device to iOS 18.1, iPadOS 18.1, visionOS 2.1, or tvOS 18.1.
CVE-2024-44252 affects devices running iOS versions up to 17.7.1 and those between iOS 18.0 and 18.1.
Yes, restoring a maliciously crafted backup file can trigger CVE-2024-44252, potentially leading to system file modifications.
Currently, there are no effective workarounds for CVE-2024-44252, and updating is strongly recommended.