Latest Apple iOS vulnerabilities #
On March 5th, 2024, Apple disclosed several vulnerabilities in its iOS and iPadOS operating systems used on its phones and tablets.
Two issues, CVE-2024-23225 and CVE-2024-23296 allow attackers to bypass memory protections on the affected device and execute code with elevated privileges. Apple has indicated that there is evidence that these vulnerabilities have been exploited in the wild.
Two additional issues CVE-2024-23243 and CVE-2024-23256 were also disclosed and allow attackers to potentially gather sensitive information without proper authorization.
Apple has stated that other CVEs may be added later, indicating that there may be further vulnerabilities present. This blog post will be updated with any new reports upon disclosure.
What is the impact? #
Upon successful exploitation of CVE-2024-23225 and CVE-2024-23296, attackers with access to the device would be able to bypass memory protections, potentially leading to complete device compromise.
Are updates or workarounds available? #
Apple has released new versions of iOS and iPadOS to address these vulnerabilities. All users are urged to update as quickly as possible.
How do I find potentially vulnerable Apple devices with runZero? #
From the Asset Inventory, use the following query to locate assets running potentially vulnerable versions of the affected products:
os:="Apple iOS" OR os:="Apple iPadOS"
