CVE-2024-23284: 
NixOS vulnerability analysis and mitigation

CVE-2024-23284 is a security vulnerability affecting multiple Apple operating systems and Safari browser. The issue was discovered in WebKit, Apple's web browser engine, and was fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. The vulnerability was identified by researchers Georg Felber and Marco Squarcina (Apple Security).

The vulnerability is a logic issue in WebKit that could prevent Content Security Policy (CSP) from being enforced when processing maliciously crafted web content. The issue was addressed with improved state management and is tracked as WebKit Bugzilla: 267241. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (NVD).

When exploited, this vulnerability could allow a malicious website to bypass Content Security Policy protections. CSP is a critical security mechanism that helps prevent various types of attacks, including cross-site scripting (XSS) and other content injection attacks. The bypass could potentially allow attackers to inject unauthorized content into web pages (WebKit Security Advisory).

The vulnerability requires user interaction (visiting a maliciously crafted website) and can be exploited remotely through network access. No authentication is required to exploit this vulnerability, though user interaction is necessary. There are no reports of this vulnerability being exploited in the wild (NVD).

Apple has released patches for this vulnerability across multiple platforms. Users should update to tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, or Safari 17.4 depending on their device. Additionally, the WebKitGTK and WPE WebKit platforms have been updated to version 2.44.0 to address this issue (Fedora Update).