PT-2024-5374 · Webkit+1 · Webkit+1

Ryan Pickren · Published 2024-06-10 · Updated 2024-07-03 · CVE-2024-27812

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions visionOS versions prior to 1.2

Description The issue is related to an uncontrolled resource consumption in the WebKit component of the visionOS operating system. Exploitation of this issue may allow a remote attacker to inject arbitrary 3D objects and cause a denial-of-service. Processing web content may lead to a denial-of-service. The issue was addressed with improvements to the file handling protocol.

Recommendations For versions prior to 1.2, update to visionOS 1.2 to resolve the issue. As a temporary workaround, consider restricting the processing of web content to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2024-06007

CVE-2024-27812

Affected Products

Webkit

Visionos

References · 17

• https://osv.dev/vulnerability/CVE-2024-27812 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27812 · Security Note
• https://bdu.fstec.ru/vul/2024-06007 · Security Note
• https://support.apple.com/kb/HT214108 · Vendor Advisory
• https://support.apple.com/en-us/HT214108 · Vendor Advisory
• https://t.me/tmfeed/206478 · Telegram Post
• https://t.me/cvenotify/82701 · Telegram Post
• http://seclists.org/fulldisclosure/2024/Jun/5 · Note
• https://t.me/true_secator/5888 · Telegram Post
• https://ryanpickren.com/vision-pro-hack · Note
• https://t.me/cvenotify/82781 · Telegram Post
• https://t.me/cvenotify/82933 · Telegram Post
• https://t.me/cvenotify/85015 · Telegram Post
• https://twitter.com/CVEnew/status/1800290552971513961 · Twitter Post
• https://seclists.org/fulldisclosure/2024/Jun/5 · Note