CVE-2024-54508: Apple Safari DOS Vulnerability

CVE-2024-54508 Overview

CVE-2024-54508 is a memory handling vulnerability affecting Apple's WebKit browser engine across multiple Apple platforms. The flaw allows maliciously crafted web content to trigger an unexpected process crash, resulting in a denial of service condition. This vulnerability impacts Safari and the WebKit rendering engine used across Apple's entire ecosystem including iOS, iPadOS, macOS, tvOS, watchOS, and visionOS.

Critical Impact

Processing maliciously crafted web content may lead to an unexpected process crash, enabling remote attackers to cause denial of service across Apple's entire device ecosystem through a single malicious webpage.

Affected Products

• Apple Safari (versions prior to 18.2)
• Apple iOS and iPadOS (versions prior to 18.2)
• Apple macOS Sequoia (versions prior to 15.2)
• Apple tvOS (versions prior to 18.2)
• Apple watchOS (versions prior to 11.2)
• Apple visionOS (versions prior to 2.2)

Discovery Timeline

• December 12, 2024 - CVE-2024-54508 published to NVD
• November 3, 2025 - Last updated in NVD database

Technical Details for CVE-2024-54508

Vulnerability Analysis

This vulnerability resides in WebKit's memory handling routines when processing web content. The flaw can be triggered remotely through network-accessible web content without requiring any privileges or user interaction beyond visiting a malicious webpage. The attack results in a complete availability impact, causing the affected browser or application process to crash unexpectedly. While confidentiality and integrity are not directly compromised, the denial of service impact is significant given the widespread use of WebKit across Apple's product line.

Root Cause

The root cause of CVE-2024-54508 stems from improper memory handling within WebKit when processing specially crafted web content. While Apple has not disclosed specific technical details about the vulnerable code path, the fix involved improving memory handling routines to properly manage memory operations during content processing. Memory handling vulnerabilities in browser engines typically arise from incorrect bounds checking, improper object lifecycle management, or failure to handle edge cases in memory allocation and deallocation sequences.

Attack Vector

The attack vector for CVE-2024-54508 is network-based, requiring an attacker to host or inject malicious web content that a victim's browser or WebKit-based application processes. The attack has low complexity and does not require authentication or user interaction beyond normal browsing activity. Potential attack scenarios include:

• Hosting a malicious webpage that victims are lured to visit
• Injecting malicious content through compromised advertising networks
• Exploiting vulnerable web applications to serve crafted content to users
• Man-in-the-middle attacks to inject malicious content into legitimate web traffic

The vulnerability enables attackers to reliably crash the browser or any application using WebKit for content rendering, disrupting user activity and potentially causing data loss in unsaved work.

Detection Methods for CVE-2024-54508

Indicators of Compromise

• Repeated unexpected Safari or WebKit-based application crashes
• Process crash logs showing termination in WebKit memory handling functions
• Unusual network traffic to unfamiliar domains preceding browser crashes
• Multiple crash reports from the same user within short time periods

Detection Strategies

• Monitor system crash logs for WebKit-related process terminations and memory-related error signatures
• Implement web filtering to block known malicious domains serving exploit content
• Deploy endpoint detection solutions capable of identifying abnormal browser process behavior
• Analyze network traffic for suspicious web content patterns associated with WebKit exploitation

Monitoring Recommendations

• Enable crash reporting and centralized log collection across managed Apple devices
• Monitor for elevated rates of browser crashes across your fleet that may indicate active exploitation
• Track visits to newly registered or low-reputation domains that could host exploit content
• Implement anomaly detection for browser process stability metrics

How to Mitigate CVE-2024-54508

Immediate Actions Required

• Update Safari to version 18.2 or later immediately
• Update iOS and iPadOS devices to version 18.2 or later
• Update macOS Sequoia to version 15.2 or later
• Update tvOS to version 18.2, watchOS to version 11.2, and visionOS to version 2.2

Patch Information

Apple has released security updates addressing this vulnerability across all affected platforms. The fixes improve memory handling to prevent the crash condition when processing malicious web content. Detailed patch information is available through Apple's security advisories:

• Safari 18.2 Security Update
• iOS 18.2 and iPadOS 18.2 Security Update
• macOS Sequoia 15.2 Security Update
• tvOS 18.2 Security Update
• watchOS 11.2 Security Update
• visionOS 2.2 Security Update

Additional advisories have been published to the Full Disclosure Mailing List and Debian LTS Announcement for Debian-based systems using WebKitGTK.

Workarounds

• Restrict browsing to known trusted websites until patches can be applied
• Use content blockers or browser extensions to filter potentially malicious web content
• Consider using alternative browsers not based on WebKit as a temporary measure on macOS
• Implement network-level filtering to block access to known malicious domains
• Enable automatic updates to ensure timely patch deployment

# Check current Safari version on macOS
/usr/bin/defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionString

# Check for available software updates on macOS
softwareupdate --list

# Install all available updates on macOS
sudo softwareupdate --install --all

# For iOS devices, check version via command line (if supervised)
# Settings > General > About > Software Version should show 18.2 or later