Apple iOS and iPadOS Managed Configuration Symlink Handling Vulnerability Leading to Unauthorized Modification of System Files

A vulnerability exists in the Managed Configuration feature of iOS and iPadOS, specifically in versions prior to iPadOS 17.7.4 and iOS 18.3. This vulnerability allows for the unauthorized modification of protected system files by restoring a maliciously crafted backup file. The issue arises from improper handling of symbolic links, which can be exploited to manipulate file system permissions and access sensitive system areas.

Impact

Exploitation of this vulnerability could result in unauthorized changes to critical system files, potentially leading to system instability or unauthorized access to sensitive information.

Remediation

Users can update to iPadOS 17.7.4, iOS 18.3, or iPadOS 18.3 to address this vulnerability.