cbcvebase.
CVE-2024-44308
published 2024-11-20

CVE-2024-44308: The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia…

PriorityP187high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2024-12-12
Exploited in the wild
EPSS
9.19%
94.8th percentile
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

Affected

18 ranges
VendorProductVersion rangeFixed in
appleios17.7.2_and_ipados
appleios18.1.1_and_ipados
appleios_and_ipados< 17.7.217.7.2
appleios_and_ipados< 18.1.118.1.1
appleipados< 17.7.217.7.2
appleipados>= 18.0 < 18.1.118.1.1
appleiphone_os< 17.7.217.7.2
appleiphone_os>= 18.0 < 18.1.118.1.1
applemacos< 15.1.115.1.1
applemacos>= 15.0 < 15.1.115.1.1
applemacossequoia
applesafari< 18.1.118.1.1
applesafari18.1.1
applevisionos< 2.1.12.1.1
applevisionos2.1.1
debiandebian_linux
debianwebkit2gtk< webkit2gtk 2.46.4-1~deb12u1 (bookworm)webkit2gtk 2.46.4-1~deb12u1 (bookworm)
debianwpewebkit< webkit2gtk 2.46.4-1~deb12u1 (bookworm)webkit2gtk 2.46.4-1~deb12u1 (bookworm)

Detection & IOCsextracted from sources · hover to see the quote

  • Vulnerability resides in the JavaScriptCore (JIT compiler) component of WebKit/WebKitGTK; detection should focus on exploitation attempts via maliciously crafted web content targeting this engine
  • Active in-the-wild exploitation confirmed on Intel-based Mac systems; prioritize detection/hunting on that platform
  • On Red Hat Enterprise Linux 7, the JIT engine can be disabled as a mitigation by setting the JavaScriptCoreUseJIT environment variable to 0; presence of this env var set to 1 (or absent) on RHEL7 systems running WebKitGTK indicates exposure
  • On RHEL7, gnome-shell can be exploited by a local network attacker without user interaction when WebKitGTK is present; monitor gnome-shell network activity and WebKitGTK process behaviour for anomalous code execution
  • Packages that load WebKitGTK on RHEL7 and represent attack surface include: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi, and yelp; monitor these processes for unexpected child process spawning or memory anomalies
  • ·WebKitGTK JIT engine must be enabled for exploitation; RHEL 8 and 9 have it disabled by default and are not affected
  • ·Exploitation requires an attacker to trick a user into processing or loading malicious web content (except in gnome-shell on RHEL7, which is exploitable from the local network without user interaction)

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vulncheck8.8HIGH
cisa8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.