CVE-2016-7601 in iOS
Summary
by MITRE
An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Local Authentication" component, which does not honor the configured screen-lock time interval if the Touch ID prompt is visible.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/05/2022
The vulnerability identified as CVE-2016-7601 resides within Apple's iOS operating system and specifically impacts versions prior to 10.2. This security flaw exists within the Local Authentication framework, which governs how iOS handles biometric authentication mechanisms including Touch ID. The issue manifests when a user has configured a specific screen lock time interval for their device, typically set to automatically lock the screen after a period of inactivity. When the Touch ID authentication prompt is actively displayed on screen, the system fails to respect the user-configured lock timeout settings, creating a potential security risk that undermines the intended device protection mechanisms. This behavior represents a deviation from expected security protocols where the device should maintain consistent authentication policies regardless of the active authentication interface.
The technical nature of this vulnerability stems from how the Local Authentication component manages session timeouts and authentication state transitions. When Touch ID is engaged, the system should continue to monitor and enforce the configured screen lock interval, but instead maintains the authentication prompt indefinitely until the user explicitly interacts with the interface or the authentication process completes. This creates a window where unauthorized users could potentially access the device if they gain physical access while the Touch ID prompt remains visible, particularly when the device has been idle for longer than the configured timeout period. The flaw essentially allows bypassing the expected security controls through the authentication interface itself, creating a scenario where the device's security posture becomes inconsistent during active authentication sessions.
From an operational impact perspective, this vulnerability significantly weakens the security model of iOS devices by creating an inconsistent authentication policy. Users who have configured their devices to lock after a specific period of inactivity may unknowingly leave their devices in a vulnerable state when Touch ID prompts are visible. Attackers could exploit this by presenting an unlocked device to an unsuspecting user, potentially allowing access to sensitive information or applications during the extended authentication window. The vulnerability affects all iOS devices running versions before 10.2, including iPhone, iPad, and iPod touch models that support Touch ID functionality. This issue particularly impacts enterprise environments where device security policies are strictly enforced, as the inconsistency in authentication behavior could lead to compliance violations and unauthorized access incidents.
The vulnerability aligns with CWE-617, which addresses "Reachable Assertion" and represents a broader class of security issues where system behavior deviates from expected security policies. From an attacker's perspective, this flaw maps to techniques described in the MITRE ATT&CK framework under credential access and privilege escalation tactics. The vulnerability could be leveraged in combination with other attack vectors, such as physical access attacks or social engineering scenarios where an attacker might wait for a user to authenticate with Touch ID, then exploit the extended timeout window to gain unauthorized access. Apple's patch for this vulnerability in iOS 10.2 addressed the core issue by ensuring that the Local Authentication component properly enforces screen lock intervals regardless of authentication interface state. Organizations should implement immediate mitigations by upgrading affected devices to iOS 10.2 or later, while also reviewing their device security policies to account for potential inconsistencies in authentication behavior that may have existed prior to the patch.