Vulnerability

CERT-In Vulnerability Note CIVN-2025-0094
Denial of Service (DoS) Vulnerability in Apple Products

Original Issue Date:May 12, 2025

Severity Rating: HIGH

Software Affected

iOS versions prior to 18.3 (for iPhone XS and later)
iPadOS versions prior to 17.7.3 (for iPad Pro 12.9-inch 2nd generation, iPad Pro 10.5-inch, and iPad 6th generation)
iPadOS versions prior to 18.3 (for iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later)

Overview

A vulnerability in Apple's iOS and iPadOS may allow certain malicious applications to cause affected devices to become unresponsive or non-functional until restored.

Target Audience:
Users of affected iOS and iPadOS devices.

Risk Assessment:
Very High risk of rendering devices inoperable.

Impact Assessment:
Potential for bricking devices.

Description

Darwin notifications are a low-level messaging system within the CoreOS layer, enabling processes to broadcast and receive system-wide event notifications.

The vulnerability arises due to the fact that any iOS application can transmit sensitive system-level Darwin notifications without needing special privileges or entitlements.

Successful exploitation of these vulnerabilities could allow malicious applications to cause affected devices to become unresponsive or non-functional until restored.

Solution

Apply appropriate fixes as mentioned in the Apple Security Advisory:
https://support.apple.com/en-us/122066

https://support.apple.com/en-us/121838

Vendor Information

Apple
https://support.apple.com/en-us/122066
https://support.apple.com/en-us/121838

References

https://cybersecuritynews.com/ios-critical-vulnerability-brick-iphones/

CVE Name
CVE-2025-24091

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India