CVE-2024-40771
Published: 15 January 2025
Summary
CVE-2024-40771 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Apple Macos. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 22.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2024-40771 is a memory handling vulnerability affecting the kernel in multiple Apple operating systems, including iOS and iPadOS prior to versions 16.7.8 and 17.5, macOS Monterey prior to 12.7.5, macOS Sonoma prior to 14.5, macOS Ventura prior to 13.6.7, tvOS prior to 17.5, visionOS prior to 1.2, and watchOS prior to 10.5. The issue allows an app to execute arbitrary code with kernel privileges and is associated with CWE-863 (Incorrect Authorization), though detailed CWE mapping is unavailable from NVD.
Exploitation requires local access (AV:L) with low privileges (PR:L), such as a malicious app installed and executed by a user, and features low attack complexity (AC:L) with no user interaction required (UI:N). Successful attacks achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) without scope change (S:U), earning a CVSS v3.1 base score of 7.8. This enables full kernel compromise from a local app context.
Apple's security advisories, detailed at support.apple.com/en-us/120898 through 120902, state that the vulnerability was addressed via improved memory handling in the listed patched versions. Security practitioners should prioritize updating affected devices to these releases for mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38845
Vulnerability details
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app…
more
may be able to execute arbitrary code with kernel privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Kernel memory handling flaw directly enables local arbitrary code execution with kernel privileges, mapping to Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely flaw remediation through patching, directly addressing the kernel memory handling vulnerability fixed in CVE-2024-40771.
Implements memory protection methods that counter memory corruption exploits enabling arbitrary kernel code execution from apps as in CVE-2024-40771.
Enforces process isolation to prevent user-space applications from accessing or executing in kernel memory space via vulnerabilities like CVE-2024-40771.