CVE-2024-23206
Overview
Background
- WebContent sandbox profile
- The seatbelt (.sb) policy restricting what the sandboxed WebContent process may access.
- file-read-metadata
- A sandbox operation permitting stat-like reads of a file’s metadata (existence, size, timestamps) without reading contents.
- Device fingerprinting
- Deriving a stable per-device identifier from observable state to track a user across origins.
Root Cause Analysis
This is a sandbox-hardening fix, not a memory-safety bug.
The patch adds a single rule to the iOS WebContent sandbox profile (com.apple.WebKit.WebContent.sb.in): (deny file-read-metadata (literal "/private/var/db/MobileIdentityData/Version.plist")). Before the change, the profile did not deny access to this path, so the sandboxed WebContent process — which runs untrusted web content — was able to read metadata for /private/var/db/MobileIdentityData/Version.plist. That file is a stable, device-specific system artifact, and its metadata (e.g. presence, size, timestamps) is consistent per device and largely invariant across origins and sessions. The violated invariant is sandbox least-privilege: WebContent should not be able to observe stable device-identifying state that a webpage could turn into a fingerprint. By reading metadata of this file, a malicious page could derive a persistent identifier and correlate the user across sites, which matches the advisory’s ‘may be able to fingerprint the user’ impact.
The fix restores the invariant by explicitly denying file-read-metadata on that literal path, closing the side channel at the sandbox boundary. INFERENCE: the exact WebContent code path that reached the file (which API or probe a page used) is not in this diff — the patch only shows the policy rule — so the specific trigger is not established by the commit, only that the capability existed and was removed.
Attack Path
- Load a malicious webpage The victim visits an attacker-controlled page whose JavaScript runs in the sandboxed WebContent process.
- Probe the device-identifying file's metadata The page drives a code path in WebContent that stats/reads metadata of /private/var/db/MobileIdentityData/Version.plist, which the pre-patch sandbox allowed.
- Derive a stable identifier Metadata of this per-device system file is consistent across origins and sessions, yielding a value usable as a device fingerprint.
- Correlate the user across sites The attacker (and colluding sites) use the derived identifier to track the user without cookies or storage, defeating anti-tracking protections.
Impact Assessment
Files Changed
Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in
Audit Directions
- Other stable device files reachable from WebContentDiff the WebContent .sb profile against files whose metadata is per-device and stable (identity/provisioning plists); each readable one is a fingerprint source.
- Metadata vs content readsLook for paths allowed for file-read-metadata but not file-read-data; even metadata-only access can leak stable identifiers.
Patch
diff --git a/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in b/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in index 9734cf26a015..a37b59016703 100644 --- a/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in +++ b/Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in @@ -37,6 +37,9 @@ (allow process-info-codesignature) #endif +(deny file-read-metadata + (literal "/private/var/db/MobileIdentityData/Version.plist")) + ;;; ;;; The following rules were originally contained in 'common.sb'. We are duplicating them here so we can ;;; remove unneeded sandbox extensions.