CVE-2024-40771
Last modified
CVE-2024-40771 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2, watchOS 10.5. EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app may be able to execute arbitrary code with kernel privileges.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apple | Ipados | < 16.7.8 |
| Apple | Ipados | >= 17.0, < 17.5 |
| Apple | Iphone Os | < 16.7.8 |
| Apple | Iphone Os | >= 17.0, < 17.5 |
| Apple | Macos | < 13.6.7 |
| Apple | Macos | >= 12.0, < 12.7.5 |
| Apple | Macos | >= 13.0, < 13.6.7 |
| Apple | Macos | >= 14.0, < 14.5 |
| Apple | Tvos | < 17.5 |
| Apple | Visionos | < 1.2 |
References
- https://support.apple.com/en-us/120898Release Notes, Vendor Advisory
- https://support.apple.com/en-us/120899Release Notes, Vendor Advisory
- https://support.apple.com/en-us/120900Release Notes, Vendor Advisory
- https://support.apple.com/en-us/120901Release Notes, Vendor Advisory
- https://support.apple.com/en-us/120902Release Notes, Vendor Advisory
- https://support.apple.com/en-us/120903Release Notes, Vendor Advisory
- https://support.apple.com/en-us/120905Release Notes, Vendor Advisory
- https://support.apple.com/en-us/120906Release Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-40771?
How severe is CVE-2024-40771?
How do I fix CVE-2024-40771?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-40764Heap-based buffer overflow vulnerability in the SonicOS IPSe…7.5
- CVE-2024-40765An Integer-based buffer overflow vulnerability in the SonicO…9.8
- CVE-2024-40766An improper access control vulnerability has been identified…9.8
- CVE-2024-40767In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 be…6.5
- CVE-2024-4077Improper Neutralization of Input During Web Page Generation …7.1
- CVE-2024-40770A permissions issue was addressed with additional restrictio…7.5
- CVE-2024-40774A downgrade issue was addressed with additional code-signing…7.1
- CVE-2024-40775A downgrade issue was addressed with additional code-signing…5.5
- CVE-2024-40776A use-after-free issue was addressed with improved memory ma…4.3
- CVE-2024-40777An out-of-bounds access issue was addressed with improved bo…5.5
- CVE-2024-40778An authentication issue was addressed with improved state ma…3.3
- CVE-2024-40779An out-of-bounds read was addressed with improved bounds che…5.5
Are you affected by CVE-2024-40771?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST