Xiaolong Bai

An integer overflow issue was identified and addressed by implementing 64-bit timestamps. This could allow an application to gain root privileges. The issue affects multiple Apple operating systems. The vulnerability was discovered by Kaitao Xie and Xiaolong Bai of Alibaba Group.

Name of the Vulnerable Software and Affected Versions: visionOS versions prior to 2.1 iOS versions prior to 18.1 iPadOS versions prior to 18.1 iOS versions prior to 17.7.1 iPadOS versions prior to 17.7.1 tvOS versions prior to 18.1 macOS Sonoma versions prior to 14.7.1 watchOS versions prior to 11.1 macOS Ventura versions prior to 13.7.1 Description: A denial-of-service issue was addressed with improved input validation. A remote attacker may be able to cause a denial-of-service. Recommendations: Update to visionOS 2.1 or later. Update to iOS 18.1 or later. Update to iPadOS 18.1 or later. Update to iOS 17.7.1 or later. Update to iPadOS 17.7.1 or later. Update to tvOS 18.1 or later. Update to macOS Sonoma 14.7.1 or later. Update to watchOS 11.1 or later. Update to macOS Ventura 13.7.1 or later.

A use-after-free issue was addressed with improved memory management, which may allow an app to execute arbitrary code with kernel privileges. The issue is related to memory management and can be exploited to gain kernel privileges.

The issue allows an app to bypass Privacy preferences. It was addressed with improved checks.

A logic issue was addressed with improved state management, which may allow an app to modify protected parts of the file system.

The issue is related to insufficient warnings about dangerous actions, which may allow an attacker to bypass existing security restrictions. A shortcut may be able to use sensitive data with certain actions without prompting the user.

The issue allows a shortcut to use sensitive data with certain actions without prompting the user. This was addressed with additional permissions checks.

The issue is related to insecure temporary files in the Shortcuts component of macOS Ventura, which may allow an attacker to access confidential information. This privacy issue can be exploited by an app to observe unprotected user data due to improper handling of temporary files.

A local user may be able to read a persistent account identifier. This issue was addressed with a new entitlement.

A device configuration issue was addressed with an updated configuration. This issue allows a device to be passively tracked by its Bluetooth MAC address.

An out-of-bounds write issue was addressed with improved bounds checking, allowing an application to potentially execute arbitrary code with kernel privileges.

An out-of-bounds write issue was addressed with improved bounds checking, allowing an application to potentially execute arbitrary code with kernel privileges.

A memory corruption issue was addressed with improved memory handling, allowing an application to potentially execute arbitrary code with kernel privileges.

A use after free issue was addressed with improved memory management, which may allow an application to gain elevated privileges.

A permissions issue was addressed by removing vulnerable code and adding additional checks. A malicious application may be able to access restricted files.

An authorization issue was addressed with improved state management. A malicious application may be able to read sensitive location information.

A memory corruption issue was addressed with improved state management, allowing an application to potentially execute arbitrary code with kernel privileges.

A memory corruption issue was addressed with improved memory handling, allowing an application to potentially execute arbitrary code with kernel privileges.

A validation issue existed in the entitlement verification, which has been addressed with improved validation of the process entitlement.

This issue was addressed with improved entitlements.