Apple devices have a strong reputation for privacy, but even the world's biggest tech companies aren't immune to occasional slip-ups. One issue that flew under the radar, but had the potential to expose sensitive data, is CVE-2023-42857. Let's break down what went wrong, how Apple fixed it, and what it means for you as a user or developer.

What is CVE-2023-42857?

Put simply, CVE-2023-42857 is a privacy flaw in Apple operating systems: macOS Sonoma, iOS, and iPadOS. Apps on affected systems could have gained access to sensitive user data through log entries that weren't properly redacted.

iPadOS (earlier than 17.1)

Fixed in:

How Did This Happen?

Operating systems and apps generate logs for debugging and error tracking. These logs sometimes capture details like file paths, error messages, or (rarely) sensitive info like user credentials.

The bug:
Apple's logging system wasn't always careful enough. It sometimes failed to hide (redact) sensitive info in logs, meaning apps could read log entries and pull out private details—information that should have been kept secure.

Example Exploit Scenario

Suppose you're using a note-taking app. The app runs into an error opening a file with your personal notes. The OS logs this activity. Because of CVE-2023-42857, the log entry might look like:

Error: Failed to open file at path /Users/alex/Documents/private/medical_notes.txt

A *different* app, with permission to read system logs (like a diagnostic app), could scan those logs and find:

Maybe even partial contents if the log was extra verbose

This isn't the kind of information you want floating around.

Let's look at how an app might grab these leaked logs on a vulnerable system

import os.log

let logStore = try! OSLogStore.local()
let oneHourAgo = Date().addingTimeInterval(-360)
let position = logStore.position(date: oneHourAgo)

for entry in try! logStore.getEntries(at: position, matching: nil) {
    if let logEntry = entry as? OSLogEntryLog {
        if logEntry.composedMessage.contains("private/medical_notes.txt") {
            print("Potential privacy breach: \(logEntry.composedMessage)")
        }
    }
}

NOTE: This code requires appropriate entitlements, but some apps (including ones with bug-reporting features) already have these.

How Apple Fixed It

Apple quickly addressed the issue by improving how private data gets redacted in logs. Basically, the system scans for private or identifiable info and ensures it's either replaced with safe placeholders or deleted entirely before going into log entries.

So after the fix, a log entry looks something like

Error: Failed to open file at path [REDACTED]

No more privacy leaks from innocent debugging tools.

What Should You Do?

If you're an Apple device user:

Make sure your operating systems are up to date

- Update your iPhone or iPad
- Update your Mac

If you're a developer:

References and Further Reading

- Apple's official advisory: Apple security updates
- CVE-2023-42857 Entry on MITRE
- OSLogStore Documentation

Final Thoughts

While CVE-2023-42857 didn't make front-page news, it’s a reminder that even routine backend features like logging can introduce real privacy risks. Apple squashed the bug in macOS 14.1, iOS 17.1, and iPadOS 17.1. Still, it's a great moment for developers to review logging habits and for users to keep their devices updated.

Timeline

Published on: 10/25/2023 19:15:10 UTC
Last modified on: 11/02/2023 18:00:33 UTC