Security features bypass in macOS - CVE-2024-40822

Vulnerability identifier: #VU94910

CSH Severity: Low

CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-40822

CWE-ID: CWE-254

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists due to a lock screen bypass in Siri. An attacker with physical access to the system can gain access contacts from the lock screen.

macOS
watchOS
Apple iOS
iPadOS

Install updates from vendor's website.

macOS - update to 14.6 23G80
watchOS - update to 10.6
Apple iOS - addressed in versions 16.7.9 20H348, 17.6 21G80
iPadOS - addressed in versions 16.7.9 20H348, 17.6 21G80

• https://support.apple.com/en-us/HT214119

• Multiple vulnerabilities in Apple macOS Sonoma
• Multiple vulnerabilities in Apple iOS 17 and iPadOS 17
• Multiple vulnerabilities in Apple iOS 16 and iPadOS 16
• Multiple vulnerabilities in Apple watchOS