The landmark iPhone hardware bypass of the past two years has just been formally blessed as an active weapon. No patch arrived, no new bug surfaced, and not one line of Apple code moved. What changed is a single row on a federal list.
US authorities added an Apple authentication bypass, tracked as CVE-2024-27834, to the Known Exploited Vulnerabilities catalog after researchers documented attackers chaining it in the field.
The guard that made iPhone exploits expensive
Apple silicon protects control flow with pointer authentication, a scheme that signs the pointers a program uses to jump around memory. With read and write primitives in hand, the signing normally still holds the line.
This defect breaks that check rather than the memory around it. Researchers demonstrated it at Pwn2Own Vancouver in March 2024, and Apple shipped improved validation the following month in iOS 17.5, Sonoma 14.5 and the matching tvOS, watchOS and Safari builds.
Why a five point five still matters
Alone it grants nothing: an attacker with no foothold gets no benefit. Its value appears in a chain, where it converts a memory corruption crash into reliable code execution.
The alarm came from Sekoia, whose Poisoned Source analysis tied a watering-hole operation to Russian intelligence. A payload aimed at iOS 16.7 paired a Safari memory write flaw with this bypass to lift browser cookies.
What an owner should take from it
There is no new update to install. The hole was closed for devices on the May 2024 releases, and any phone updated since has carried the check.
That leaves laggards on iOS 16.7 or earlier as the intended target, and for them the fix means jumping two major generations. The catalog entry drives a requirement for agencies, not a notice to the public.
Source: The Hacker News
