CVE-2024-27804: Apple iPadOS DOS Vulnerability

CVE-2024-27804 Overview

CVE-2024-27804 is a memory handling vulnerability affecting multiple Apple operating systems. A local application can trigger unexpected system termination by exploiting improper memory management. Apple addressed the issue with improved memory handling across iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.3, and watchOS 10.5. The vulnerability requires local access and user interaction, with impact limited to availability. The flaw maps to [CWE-770] (Allocation of Resources Without Limits or Throttling) and [CWE-1325] (Improperly Controlled Sequential Memory Allocation).

Critical Impact
A malicious application installed on the device can cause unexpected system termination, resulting in denial of service across affected Apple platforms.

Affected Products

Apple iOS and iPadOS versions prior to 17.5
Apple macOS Sonoma versions prior to 14.5
Apple tvOS prior to 17.5, watchOS prior to 10.5, and visionOS prior to 1.3

Discovery Timeline

2024-05-14 - CVE-2024-27804 published to NVD
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2024-27804

Vulnerability Analysis

The vulnerability stems from improper memory handling within shared components used across Apple's operating system family. An application running locally on an affected device can trigger a condition that leads to unexpected system termination. The attack vector is local with low complexity and requires user interaction, typically through installation and execution of a malicious application.

The issue is categorized under [CWE-770] and [CWE-1325], indicating insufficient throttling or control over sequential memory allocations. Apple's advisory describes the resolution as "improved memory handling," suggesting the original code path failed to enforce proper bounds or lifecycle controls on memory operations triggered by application-level input.

Root Cause

The root cause is improper memory handling in a system component shared across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Without proper limits on memory allocation or sequential access patterns, an application can drive the kernel or system service into a state that forces termination. The cross-platform nature of the flaw indicates it resides in shared Darwin or XNU code utilized by every affected operating system.

Attack Vector

Exploitation requires an attacker to deliver a crafted application to the target device. The application must be installed and executed by the user. Once running, the application issues operations that exercise the vulnerable memory handling logic, causing the affected system process to terminate unexpectedly. The vulnerability does not enable code execution or information disclosure but produces a denial-of-service condition on the device.

No public proof-of-concept exploit code is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Apple Security Advisory HT214101 and related advisories for vendor-supplied technical context.

Detection Methods for CVE-2024-27804

Indicators of Compromise

Unexpected system reboots or kernel panics on Apple devices running pre-patch OS versions
Crash logs referencing abnormal memory allocation patterns or termination of system services
Presence of unsigned or recently sideloaded applications coinciding with system instability

Detection Strategies

Review Apple device crash and panic logs through mobile device management (MDM) telemetry for repeated unexpected terminations
Inventory managed endpoints to identify devices running iOS/iPadOS earlier than 17.5, macOS earlier than 14.5, tvOS earlier than 17.5, watchOS earlier than 10.5, or visionOS earlier than 1.3
Correlate application installation events with subsequent system stability incidents

Monitoring Recommendations

Forward MDM compliance and crash telemetry to a centralized analytics platform for trend analysis
Alert on installation of applications from non-curated sources on managed Apple devices
Track OS version compliance reports to confirm patch deployment across the fleet

How to Mitigate CVE-2024-27804

Immediate Actions Required

Update all Apple devices to iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.3, or watchOS 10.5 or later
Enforce update compliance through MDM policy and block enrollment of devices running unpatched versions
Restrict installation of applications from untrusted sources and review existing third-party applications

Patch Information

Apple released fixes in iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.3, and watchOS 10.5. Patch details are published in the Apple Security Advisory HT214101, HT214102, HT214104, HT214106, and HT214123.

Workarounds

No vendor workaround exists; applying the security update is the only supported remediation
Limit installation of untrusted applications until devices can be updated
Use MDM configuration profiles to restrict application sources and enforce minimum OS versions

bash

# Verify current macOS version against patched baseline
sw_vers -productVersion

# Trigger software update check on macOS
sudo softwareupdate -l
sudo softwareupdate -ia --restart