CVE-2024-23206
Overview
Advisory: Apple Security Advisory
Impact:
Description: A maliciously crafted webpage may be able to fingerprint the user
Researchers: an anonymous researcher
| Attribute | Value |
|---|---|
| CVE | CVE-2024-23206 |
| Bugzilla | 262699 |
| Component | WebKit |
| Bug Class | LogicError |
| Severity | medium |
| Commit | 89314de81d9bcf4a… |
| Advisory | Apple Advisory |
Root Cause Analysis
An access issue was addressed with improved access restrictions.
Files Changed
Source Files
Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in
Patch Preview
diff --git a/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in b/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in
index 9734cf26a015..a37b59016703 100644
--- a/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in
+++ b/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in
@@ -37,6 +37,9 @@
(allow process-info-codesignature)
#endif
+(deny file-read-metadata
+ (literal "/private/var/db/MobileIdentityData/Version.plist"))
+
;;;
;;; The following rules were originally contained in 'common.sb'. We are duplicating them here so we can
;;; remove unneeded sandbox extensions.