The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently made a significant entry in its Known Exploited Vulnerabilities catalog by adding a critical vulnerability in Apple products, identified as CVE-2024-27834. This particular flaw has gained attention due to evidence that it is actively being exploited by state-sponsored hackers from Russia. The vulnerability holds a Common Vulnerability Scoring System (CVSS) score of 5.5, highlighting its potential impact. Additionally, federal agencies have been given a deadline of November 18, 2026, to address and remediate this issue within their networks.
CVE-2024-27834 is particularly concerning as it targets the Pointer Authentication Code (PAC), a security mechanism designed to protect Apple silicon processors. PAC adds cryptographic signatures to memory pointers, thereby safeguarding the integrity of the memory addresses used in program execution. Under normal circumstances, this mechanism prevents attackers from hijacking a program by manipulating these pointers. However, the newly identified vulnerability enables attackers who have already gained arbitrary read and write access to a device to bypass these critical PAC protections. The result is a compromised security barrier, making exploitation attempts significantly easier.
Cybersecurity firm Sekoia has attributed recent attacks leveraging this vulnerability to APT29, a well-known Russian cyberespionage group. Sekoia expresses moderate to high confidence in this attribution. The threat actors have deployed an elaborate zero-click exploit chain that targets the Safari and Chrome web browsers. Their tactics have involved utilizing compromised websites and fake domains, along with a supply chain attack involving the Plerdy SEO Tracker service. This exploit chain effectively uses CVE-2024-27834 to forge the valid pointers that are required for executing arbitrary code on compromised devices. The malware used in these attacks is capable of harvesting sensitive information, including browser cookies and other device data.
The vulnerability does not discriminate among Apple products; it affects a broad array of devices, including those running Safari 17.5, iOS 16.7.8 and 17.5, iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, and watchOS 10.5. Apple has responded by patching the issue in these various operating systems through enhanced security checks. Importantly, on the modern architecture of Apple silicon, simply achieving arbitrary memory access is not enough for a full exploitation. The PAC protections act as an additional layer of defense, crashing processes when improperly signed pointers are detected. This makes the ability to bypass these protections particularly valuable to cybercriminals.
Under Binding Operational Directive 22-01, it becomes imperative for Federal Civilian Executive Branch agencies to remediate identified vulnerabilities in accordance with CISA’s specified deadlines. While this directive specifically targets federal entities, CISA strongly encourages the private sector to also assess their security posture. Organizations within the private sector are urged to review the Known Exploited Vulnerabilities catalog and prioritize the patching of any actively exploited vulnerabilities. For those utilizing affected Apple products, quick action is advised to deploy the available security updates, effectively removing this potential attack vector from their networks.
The ongoing threat posed by state-sponsored cyber actors has become a pressing concern in the cybersecurity landscape. As such, vigilance in software updates and adherence to best practices in cybersecurity protocols is more crucial than ever. With the ongoing scrutiny of vulnerabilities like CVE-2024-27834, organizations and individuals alike must remain proactive in defending against potential exploits, thereby ensuring a more secure digital environment.
In conclusion, as cybersecurity threats continue to evolve, timely updates and vigilance remain paramount. The responsibility lies not just with government agencies but extends to all organizations that depend on technology in today’s interconnected world. The emergence of vulnerabilities such as CVE-2024-27834 underscores the continuous need for enhanced security measures and swift response strategies to mitigate the risks associated with cyberattacks.