Full Disclosure mailing list archives

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-03-07-2024-6 tvOS 17.4

tvOS 17.4 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214086.

Apple maintains a Security Releases page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Accessibility
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A malicious app may be able to observe user data in log entries
related to accessibility notifications
Description: A privacy issue was addressed with improved private data
redaction for log entries.
CVE-2024-23291

AppleMobileFileIntegrity
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to elevate privileges
Description: This issue was addressed by removing the vulnerable code.
CVE-2024-23288: Wojciech Regula of SecuRing (wojciechregula.blog) and
Kirin (@Pwnrin)

CoreBluetooth - LE
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to access Bluetooth-connected microphones
without user permission
Description: An access issue was addressed with improved access
restrictions.
CVE-2024-23250: Guilherme Rambo of Best Buddy Apps (rambo.codes)

file
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a file may lead to a denial-of-service or potentially
disclose memory contents
Description: This issue was addressed with improved checks.
CVE-2022-48554

Image Processing
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: The issue was addressed with improved memory handling.
CVE-2024-23270: an anonymous researcher

ImageIO
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing an image may lead to arbitrary code execution
Description: A buffer overflow issue was addressed with improved memory
handling.
CVE-2024-23286: Dohyun Lee (@l33d0hyun)

Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to access user-sensitive data
Description: A race condition was addressed with additional validation.
CVE-2024-23235

Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: A memory corruption vulnerability was addressed with
improved locking.
CVE-2024-23265: Xinru Chi of Pangu Lab

Kernel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An attacker with arbitrary kernel read and write capability may
be able to bypass kernel memory protections. Apple is aware of a report
that this issue may have been exploited.
Description: A memory corruption issue was addressed with improved
validation.
CVE-2024-23225

libxpc
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to break out of its sandbox
Description: The issue was addressed with improved checks.
CVE-2024-23278: an anonymous researcher

libxpc
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to execute arbitrary code out of its sandbox
or with certain elevated privileges
Description: The issue was addressed with improved memory handling.
CVE-2024-0258: ali yabuz

MediaRemote
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A malicious application may be able to access private
information
Description: The issue was addressed with improved checks.
CVE-2024-23297: scj643

Metal
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2024-23264: Meysam Firouzi @R00tkitsmm working with Trend Micro Zero
Day Initiative

RTKit
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An attacker with arbitrary kernel read and write capability may
be able to bypass kernel memory protections. Apple is aware of a report
that this issue may have been exploited.
Description: A memory corruption issue was addressed with improved
validation.
CVE-2024-23296

Sandbox
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to leak sensitive user information
Description: A race condition was addressed with improved state
handling.
CVE-2024-23239: Mickey Jin (@patch1t)

Sandbox
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to access user-sensitive data
Description: A logic issue was addressed with improved restrictions.
CVE-2024-23290: Wojciech Regula of SecuRing (wojciechregula.blog)

Siri
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An attacker with physical access may be able to use Siri to
access sensitive user data
Description: This issue was addressed through improved state management.
CVE-2024-23293: Bistrit Dahal

Spotlight
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to leak sensitive user information
Description: This issue was addressed through improved state management.
CVE-2024-23241

UIKit
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to break out of its sandbox
Description: This issue was addressed by removing the vulnerable code.
CVE-2024-23246: Deutsche Telekom Security GmbH sponsored by Bundesamt
für Sicherheit in der Informationstechnik

WebKit
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing web content may lead to arbitrary code execution
Description: The issue was addressed with improved memory handling.
WebKit Bugzilla: 259694
CVE-2024-23226: Pwn2car

WebKit
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A malicious website may exfiltrate audio data cross-origin
Description: The issue was addressed with improved UI handling.
WebKit Bugzilla: 263795
CVE-2024-23254: James Lee (@Windowsrcer)

WebKit
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing maliciously crafted web content may prevent Content
Security Policy from being enforced
Description: A logic issue was addressed with improved validation.
WebKit Bugzilla: 264811
CVE-2024-23263: Johan Carlsson (joaxcar)

WebKit
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A maliciously crafted webpage may be able to fingerprint the
user
Description: An injection issue was addressed with improved validation.
WebKit Bugzilla: 266703
CVE-2024-23280: an anonymous researcher

WebKit
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing maliciously crafted web content may prevent Content
Security Policy from being enforced
Description: A logic issue was addressed with improved state management.
WebKit Bugzilla: 267241
CVE-2024-23284: Georg Felber and Marco Squarcina

Additional recognition

CoreAnimation
We would like to acknowledge Junsung Lee for their assistance.

CoreMotion
We would like to acknowledge Eric Dorphy of Twin Cities App Dev LLC for
their assistance.

Kernel
We would like to acknowledge Tarek Joumaa (@tjkr0wn) for their
assistance.

libxml2
We would like to acknowledge OSS-Fuzz, Ned Williamson of Google Project
Zero for their assistance.

libxpc
We would like to acknowledge Rasmus Sten, F-Secure (Mastodon:
@pajp () blog dll nu), and an anonymous researcher for their assistance.

Photos
We would like to acknowledge Abhay Kailasia (@abhay_kailasia) of Lakshmi
Narain College Of Technology Bhopal for their assistance.

Power Management
We would like to acknowledge Pan ZhenPeng (@Peterpan0927) of STAR Labs
SG Pte. Ltd. for their assistance.

Sandbox
We would like to acknowledge Zhongquan Li (@Guluisacat) for their
assistance.

Siri
We would like to acknowledge Bistrit Dahal for their assistance.

Software Update
We would like to acknowledge Bin Zhang of Dublin City University for
their assistance.

WebKit
We would like to acknowledge Nan Wang (@eternalsakura13) of 360
Vulnerability Research Institute, Valentino Dalla Valle, Pedro Bernardo,
Marco Squarcina, and Lorenzo Veronese of TU Wien for their assistance.

Apple TV will periodically check for software updates. Alternatively,
you may manually check for software updates by selecting "Settings ->
System -> Software Update -> Update Software."  To check the current
version of software, select "Settings -> General -> About."
All information is also posted on the Apple Security Releases
web site: https://support.apple.com/en-us/HT201222.

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmXqcgcACgkQX+5d1TXa
IvrIdQ/9HRpg5/rTwCLemvmrsOZ3yt/cvAd9UD9uy9BFVL3yQfAStC1GBdCIZlc7
5DUtJVCGMDb77PDK64P74Z2METMrvy5jeSCkAlCHv1FYe4F4LC8j01Dj9CEms6uI
QAfvzSMrbVaBlXJte/x1IeI+zXwtZS4XgvpYH3kjoZbeGspxOM5z3vKRvuk0WNC9
7FHJ43HFecsHF6mBe7Nr/8iwMxtsNwWKknaT4wywXE8hEde1OaSVya370H38SS+n
GuSG2ivIDN8hGVvL8pCqqVqzAtNq5BzVSQ4aQ1+4MDB8QWLP/FGnjYi83qS6hDO0
AE5TGvMOKfxqKwg4eh4ohtSvsHzXrEVG5yQgvVpz4yd4JxRizSGBloDhyDLlXL+l
1PnuFaPFx+b6EkvafIdzo4b1O2Y6CnDy0iFrXdU3pbWG/QImxL6Krg6NtXcHGFWD
h7iNnhJ14elhKEwTuoI0c9QlRTwRyCKSdrM8AEravz8VaoHGXJlb1SPtLUAejwH4
kOoAT+zAb4EOELUWtgSk4d+tQeBKhD6sgOPkn6olGi5X0HJTHxiMqFCMbfNDk8Ko
gTuMdmCOLYRbTSqoaJWW2gv9hLYoYBul9tKRgrQT6WdfKbH5WiCvZ9v7z1N4Ur8+
l7syGGcrIX/eC2lZWGfaw49fLobn8PGvaM6cxazDhEYl9BRGlpc=
=AI8u
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

• APPLE-SA-03-07-2024-6 tvOS 17.4 Apple Product Security via Fulldisclosure (Mar 13)