CVE-2024-44308
Apple Multiple Products Code Execution Vulnerability
Description
CVE-2024-44308 is a high-severity arbitrary code execution vulnerability in Apple's WebKit JavaScriptCore engine, affecting Safari, iOS, iPadOS, macOS Sequoia, and visionOS. With a CVSS v3.1 base score of 8.8, the vulnerability allows an attacker to achieve arbitrary code execution when a user processes maliciously crafted web content. Apple has confirmed that this issue may have been actively exploited on Intel-based Mac systems. CISA has added CVE-2024-44308 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 12, 2024, and its ransomware association is classified as Unknown. The EPSS score of 1.86% at the 82.8th percentile indicates active exploitation activity that places it above the majority of tracked vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| debian | debian linux | 11.0 |
| apple | safari | < 18.1.1 |
| apple | ipados | < 17.7.2; >= 18.0, < 18.1.1 |
| apple | iphone os | < 17.7.2; >= 18.0, < 18.1.1 |
| apple | macos | >= 15.0, < 15.1.1 |
| apple | visionos | < 2.1.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/121752(Vendor Advisory)
- https://support.apple.com/en-us/121753(Vendor Advisory)
- https://support.apple.com/en-us/121754(Vendor Advisory)
- https://support.apple.com/en-us/121755(Vendor Advisory)
- https://support.apple.com/en-us/121756(Vendor Advisory)
- http://seclists.org/fulldisclosure/2024/Nov/16(Mailing List, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2024/12/msg00003.html(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-44308(US Government Resource)
Weakness Type
Arbitrary Code Execution via JavaScriptCore Processing Flaw
CVE-2024-44308 is a code execution vulnerability in Apple's JavaScriptCore, the JavaScript engine used by WebKit. The flaw was addressed with improved checks, indicating that insufficient validation or bounds checking in the JavaScriptCore engine allowed maliciously crafted web content to trigger arbitrary code execution. JavaScriptCore is responsible for compiling and executing JavaScript code within the browser, and vulnerabilities in this component are especially dangerous because they can be triggered simply by visiting a web page. Code execution vulnerabilities in browser JavaScript engines represent one of the most critical classes of browser security flaws, as they can enable full system compromise from a simple web page visit. Learn more about CWE-94: Improper Control of Generation of Code ('Code Injection')
Impact Analysis
The impact of CVE-2024-44308 is severe across all three security dimensions. Confidentiality is fully compromised (C:H) because arbitrary code execution within the browser process grants the attacker access to all data accessible to that process. This includes cookies, session tokens, saved passwords, browsing history, and any data from websites the user is currently logged into. On desktop systems, the browser process may also have access to local files, clipboard data, and other sensitive system resources.
Integrity faces maximum impact (I:H) because code execution allows the attacker to modify data, install malware, create persistent backdoors, or alter system configurations. On macOS, an attacker executing code within the browser context may be able to escape the sandbox and compromise the underlying operating system, particularly on systems where additional privilege escalation vulnerabilities exist.
Availability is also fully impacted (A:H) because the attacker can crash the browser, consume system resources, or deploy destructive payloads. The combination of arbitrary code execution with confirmed active exploitation on Intel-based Mac systems suggests this vulnerability was used in sophisticated targeted attacks, potentially combined with CVE-2024-44309 (a WebKit XSS vulnerability disclosed simultaneously). The attack requires user interaction (UI:R) in the form of visiting a malicious web page, but this barrier is easily overcome through phishing, malvertising, or compromised websites. The EPSS score of 1.86% at the 82.8th percentile reflects meaningful exploitation activity that is higher than approximately 83% of all tracked vulnerabilities.
Exploit Maturity
CVE-2024-44308 has confirmed active exploitation, with Apple acknowledging that the issue "may have been actively exploited on Intel-based Mac systems." CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 12, 2024.
The EPSS score of 1.86% at the 82.8th percentile indicates exploitation activity that exceeds approximately 83% of all tracked vulnerabilities. The confirmed exploitation on Intel-based Mac systems points to targeted attacks, likely conducted by sophisticated threat actors who developed or acquired a working exploit for the JavaScriptCore vulnerability. Apple released coordinated fixes across multiple products: Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPadOS 18.1.1, and visionOS 2.1.1. The simultaneous disclosure with CVE-2024-44309 suggests both were part of the same exploit chain, where the XSS vulnerability may have been used to set up the conditions for the code execution exploit. The ransomware association remains Unknown, but arbitrary code execution vulnerabilities in browsers are high-value targets for advanced persistent threat (APT) groups.
Remediation
-
Update all affected Apple devices and software immediately. Install the latest security updates for all affected platforms: Safari 18.1.1, iOS 17.7.2 or iOS 18.1.1, iPadOS 17.7.2 or iPadOS 18.1.1, macOS Sequoia 15.1.1, and visionOS 2.1.1. These updates are available through the standard software update mechanisms on each platform and address the JavaScriptCore code execution flaw.
-
Prioritize Intel-based Mac systems for immediate patching. Apple has specifically confirmed active exploitation on Intel-based Mac systems. Organizations should treat updates to Intel-based Mac fleets as an emergency priority. Use MDM solutions to verify patch deployment status and ensure full coverage.
-
Patch CVE-2024-44309 simultaneously. CVE-2024-44308 was disclosed alongside CVE-2024-44309, a WebKit cross-site scripting vulnerability likely used in the same exploit chain. Both vulnerabilities are addressed in the same set of Apple security updates. Verify that your update installation covers both CVEs to break the complete attack chain.
-
Investigate potentially compromised Intel-based Mac systems. If Intel-based Mac systems accessed untrusted web content before the patch was applied, consider conducting a forensic assessment. Look for indicators of compromise including unusual process activity, unexpected network connections, newly installed persistence mechanisms, and unauthorized modifications to system files.
-
Implement browser security controls as defense-in-depth. Enable advanced security features such as Lockdown Mode on devices where the threat model warrants it. Deploy web content filtering to block access to known malicious domains, and consider implementing browser isolation for high-risk users who regularly access untrusted web content.
Technical Details
CVE-2024-44308 carries a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, resulting in a high base score of 8.8. The vector indicates a network-accessible vulnerability (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but needing user interaction (UI:R). The scope is unchanged (S:U), with high impact across all three dimensions: confidentiality (C:H), integrity (I:H), and availability (A:H).
The vulnerability resides in JavaScriptCore, Apple's JavaScript and WebAssembly engine that powers WebKit. JavaScriptCore is responsible for parsing, compiling (through its multi-tier JIT compilation pipeline), and executing JavaScript code within the browser. The flaw was addressed with "improved checks," which typically indicates insufficient validation, missing bounds checks, or type confusion errors in the JavaScript engine's processing pipeline.
The attack mechanism involves crafting malicious JavaScript that triggers the vulnerability during processing by JavaScriptCore. When a user visits a web page containing the malicious content, JavaScriptCore processes the JavaScript code and encounters the flawed code path, leading to memory corruption or type confusion that the attacker leverages to achieve arbitrary code execution. The code runs initially within the WebKit sandbox, but on desktop platforms, sandbox escape techniques may be chained to achieve full system compromise.
The user interaction requirement (UI:R) means the victim must navigate to a page containing the malicious content. In the confirmed exploitation scenario on Intel-based Mac systems, this was likely achieved through targeted phishing or watering hole attacks. The unchanged scope (S:U) in the CVSS vector indicates the direct impact is contained to the vulnerable component (the browser process), though in practice, code execution within the browser often serves as the first step toward broader system compromise. Affected products include Safari versions before 18.1.1, iOS and iPadOS versions before 17.7.2 and 18.1.1, macOS versions before 15.1.1, and visionOS versions before 2.1.1.
Frequently Asked Questions
What is CVE-2024-44308?
CVE-2024-44308 is a high-severity arbitrary code execution vulnerability in Apple's JavaScriptCore engine used by WebKit. It allows an attacker to execute arbitrary code on a victim's device when they visit a maliciously crafted web page. Apple has confirmed it may have been actively exploited on Intel-based Mac systems.
Which Apple products are affected by CVE-2024-44308?
The vulnerability affects Safari (before 18.1.1), iOS and iPadOS (before 17.7.2 and 18.1.1), macOS Sequoia (before 15.1.1), and visionOS (before 2.1.1). On iOS and iPadOS, all browsers are affected since they are required to use WebKit as their underlying engine, regardless of their branding.
How does CVE-2024-44308 relate to CVE-2024-44309?
Both vulnerabilities were disclosed simultaneously by Apple and affect the WebKit engine. CVE-2024-44308 enables arbitrary code execution through a JavaScriptCore flaw, while CVE-2024-44309 allows cross-site scripting through a cookie management issue. Both may have been exploited together on Intel-based Mac systems as part of a coordinated attack chain, and both are fixed in the same set of Apple security updates.
Can CVE-2024-44308 be exploited remotely?
Yes. The vulnerability can be exploited remotely by convincing a user to visit a malicious web page. No authentication or special privileges are required. The attacker only needs to host or inject malicious JavaScript content on a web page that the victim visits, making phishing links and compromised websites effective delivery mechanisms.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.