CVE-2024-40822 in macOS
Summary
by MITRE • 07/30/2024
This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, watchOS 10.6. An attacker with physical access to a device may be able to access contacts from the lock screen.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/04/2026
This vulnerability represents a significant security flaw in Apple's mobile and desktop operating systems that undermines the fundamental security model of locked devices. The issue stems from insufficient restrictions on device functionality when a device is locked, creating an exploitable pathway for attackers who possess physical access to compromised systems. The vulnerability affects multiple Apple platforms including iOS, iPadOS, macOS Sonoma, and watchOS, indicating a systemic design flaw rather than an isolated incident. The security implications extend beyond simple contact access, as it demonstrates a failure in the device's lock screen security boundaries that could potentially expose other sensitive data or system functions.
The technical flaw manifests as inadequate access controls on locked devices, allowing unauthorized individuals to bypass normal authentication mechanisms through the lock screen interface. This represents a violation of the principle of least privilege and fails to maintain proper security boundaries between authenticated and unauthenticated states. The vulnerability specifically permits access to contacts data without proper authentication, which falls under the category of information disclosure through improper access control mechanisms. This issue is particularly concerning because it operates at the user interface level where physical access can be leveraged to exploit security weaknesses that should otherwise be protected by the device's lock screen security model.
The operational impact of this vulnerability is substantial for users who may have their devices physically compromised, potentially leading to unauthorized access to personal contact information, communication data, and other sensitive details that could be exploited for social engineering attacks or identity theft. Attackers with physical access can bypass normal security controls simply by navigating through the device's lock screen interface, which undermines the trust model that users place in their device security. This vulnerability directly impacts the security posture of Apple's ecosystem and represents a failure in the device's security architecture that could enable further exploitation if similar weaknesses exist in other areas of the system.
The fix implemented by Apple addresses this issue through enhanced restriction mechanisms on locked devices, ensuring that sensitive data and functions remain properly protected even when physical access is present. This remediation aligns with the security principle of defense in depth, where multiple layers of protection work together to prevent unauthorized access. The fix requires users to update to specific versions including iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, and watchOS 10.6, demonstrating the importance of timely security updates in maintaining system integrity. This vulnerability and its resolution highlight the critical need for continuous security assessment and the implementation of proper access control mechanisms that maintain security boundaries even under physical access scenarios. The remediation approach follows industry best practices for addressing information disclosure vulnerabilities and aligns with security frameworks that emphasize the protection of sensitive data through proper access controls and authentication mechanisms.