¡¾·ì϶¹«¸æ¡¿Apple RawCamera DNG½âÎöÔ½½çдÈë·ì϶(CVE-2025-43300)

°ä²¼¹¦·ò 2025-08-25

Ò»¡¢·ì϶¸ÅÊö


·ìϼûû³Æ

Apple RawCamera DNG½âÎöÔ½½çдÈë·ì϶

CVE   ID

CVE-2025-43300

·ì϶ÀàÐÍ

Ô½½çдÈë

·¢ÏÖ¹¦·ò

2025-08-25

·ì϶ÆÀ·Ö

8.8

·ì϶µÈ¼¶

¸ßΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

ÎÞ

ÀûÓÃÄѶÈ

µÍ

Óû§½»»¥

±ØÒª

PoC/EXP

Òѹ«¿ª

ÔÚÒ°ÀûÓÃ

ÒÑ·¢ÏÖ


Apple iOSÊÇÓÉÆ»¹û¹«Ë¾¿ª·¢µÄÒƶ¯²Ù×÷ϵͳ £¬£¬£¬£¬£¬£¬£¬£¬×¨ÎªiPhone¡¢iPadºÍiPod TouchµÈÉ豸Éè¼Æ¡£¡£¡£¡£¡£Ëü»ùÓÚDarwinÄÚºË £¬£¬£¬£¬£¬£¬£¬£¬Ñ¡È¡¹ØÔ´¼Ü¹¹ £¬£¬£¬£¬£¬£¬£¬£¬ÓµÓи߻úÄÜÓëÇ¿°²È«ÐÔ¡£¡£¡£¡£¡£iOSÌṩֱ¹ÛµÄ¶àµã´¥¿Ø½çÃæ £¬£¬£¬£¬£¬£¬£¬£¬Ö§³Ö·á˶µÄÀûÓÃÉú̬ºÍÓ²¼þЭͬ £¬£¬£¬£¬£¬£¬£¬£¬ÈçFace ID¡¢Siri¡¢iCloudµÈÖ°ÄÜ¡£¡£¡£¡£¡£ÏµÍ³ÄÚÖöà²ã°²È«»úÔì £¬£¬£¬£¬£¬£¬£¬£¬Ô̺¬É³Ïä¡¢Êý¾Ý¼ÓÃܺÍÀûÓÃÊðÃû £¬£¬£¬£¬£¬£¬£¬£¬±£ÏÕÓû§ÒþÖÔÓëÉ豸°²È« £¬£¬£¬£¬£¬£¬£¬£¬ÊÇÈ«Çò×î¿í·ºÊ¹ÓõÄÒƶ¯²Ù×÷ϵͳ֮һ¡£¡£¡£¡£¡£


2025Äê8ÔÂ25ÈÕ £¬£¬£¬£¬£¬£¬£¬£¬8827Ì«Ñô¼¯Íż¯ÍÅVSRC¼à²âµ½Appleϵͳ´æÔÚRawCamera DNG½âÎöÔ½½çдÈë·ì϶£¨CVE-2025-43300£©¡£¡£¡£¡£¡£¸Ã·ì϶´æÔÚÓÚApple RawCamera.bundle´¦ÖÃAdobe DNGÎļþµÄJPEGÎÞËð½âѹʵÏÖÖÐ £¬£¬£¬£¬£¬£¬£¬£¬ÊôÓÚÁãµã»÷Ô¶³Ì´úÂëÖ´Ðзì϶¡£¡£¡£¡£¡£ÓÉÓÚÔÚ½âÎö¹ý³ÌÖв»×ã¶ÔTIFFÔªÊý¾Ý±êÇ©SamplesPerPixelÓëJPEG SOF3¶ÎÄÚcomponent countµÄÒ»ÖÂÐÔУÑé £¬£¬£¬£¬£¬£¬£¬£¬µ±Á½ÕßÊýÖµ²»Æ¥Åäʱ £¬£¬£¬£¬£¬£¬£¬£¬ÏµÍ³»áÃýÎóµØ°´SamplesPerPixel·ÖÅ仺³åÇø £¬£¬£¬£¬£¬£¬£¬£¬¶ø½âÂëÆ÷Ôò°´component countдÈëÊý¾Ý £¬£¬£¬£¬£¬£¬£¬£¬µ¼Ö¶ѻº³åÇøÒç³ö¡£¡£¡£¡£¡£¹¥»÷Õß¿Éͨ¹ý»ú¹Ø¶ñÒâDNGÎļþÓÕµ¼Ö¸±êÉ豸½âÎö £¬£¬£¬£¬£¬£¬£¬£¬´Ó¶øÒý·¢·¨Ê½±ÀÀ£¡¢Êý¾Ý°Ü»µ £¬£¬£¬£¬£¬£¬£¬£¬ÉõÖÁÔ¶³ÌÖ´ÐÐËÁÒâ´úÂë¡£¡£¡£¡£¡£Apple¹Ù·½È·Èϸ÷ì϶ÒÑÔÚÒ°±í±»ÓÃÓÚÕë¶ÔÌض¨¸ß¼ÛÖµÖ¸±êµÄ¸ß¶È¸´ÔÓ¹¥»÷ £¬£¬£¬£¬£¬£¬£¬£¬½¨ÒéÓû§¾¡¿ìÉý¼¶ÖÁÒѽ¨¸´°æ±¾¡£¡£¡£¡£¡£


¶þ¡¢Ó°ÏìÁìÓò


iOS < 18.6.2
iPadOS < 18.6.2
iPadOS 17.x < 17.7.10
macOS Sequoia < 15.6.1
macOS Sonoma < 14.7.8
macOS Ventura < 13.7.8 ¡£¡£¡£¡£¡£


Èý¡¢°²È«´ëÊ©


3.1 Éý¼¶°æ±¾


¹Ù·½ÒÑ°ä²¼°²È«²¹¶¡ £¬£¬£¬£¬£¬£¬£¬£¬Éý¼¶ÖÁÈçÏ°汾¡£¡£¡£¡£¡£
iOS >= 18.6.2
iPadOS >= 18.6.2
iPadOS 17.7.10
macOS Sequoia >= 15.6.1
macOS Sonoma >= 14.7.8
macOS Ventura >= 13.7.8
¿Éͨ¹ý ÉèÖà ¡ú ͨÓà ¡ú Èí¼þ¸üР²é³­²¢×°ÖÃ×îа²È«²¹¶¡¡£¡£¡£¡£¡£


3.2 һʱ´ëÊ©


¹Ø¹Ø×Ô¶¯Í¼ÏñÔ¤ÀÀ £¬£¬£¬£¬£¬£¬£¬£¬²¢×èÖ¹²»³ÉÐÅÆðÔ´µÄDNGÎļþ £¬£¬£¬£¬£¬£¬£¬£¬½µµÍ·ì϶ÀûÓ÷çÏÕ¡£¡£¡£¡£¡£


3.3 ͨÓý¨Òé


? ¶¨ÆÚ¸üÐÂϵͳ²¹¶¡ £¬£¬£¬£¬£¬£¬£¬£¬Ï÷¼õϵͳ·ì϶ £¬£¬£¬£¬£¬£¬£¬£¬ÌáÉý·þÎñÆ÷µÄ°²È«ÐÔ¡£¡£¡£¡£¡£
? ¼ÓǿϵͳºÍÍøÂçµÄ½Ó¼û½ÚÔì £¬£¬£¬£¬£¬£¬£¬£¬Åú¸Ä·À»ðǽսÊõ £¬£¬£¬£¬£¬£¬£¬£¬¹Ø¹Ø·Ç±ØÒªµÄÀûÓö˿ڻò·þÎñ £¬£¬£¬£¬£¬£¬£¬£¬Ï÷¼õ½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Â¶³öµ½¹«Íø £¬£¬£¬£¬£¬£¬£¬£¬Ï÷¼õ¹¥»÷Ãæ¡£¡£¡£¡£¡£
? Ê¹ÓÃÆóÒµ¼¶°²È«²úÆ· £¬£¬£¬£¬£¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂ簲ȫ»úÄÜ¡£¡£¡£¡£¡£
? ¼ÓǿϵͳÓû§ºÍȨÏÞÖÎÀí £¬£¬£¬£¬£¬£¬£¬£¬ÆôÓöà³É·ÖÈÏÖ¤»úÔìºÍ×îÓ×ȨÏÞ×¼Ôò £¬£¬£¬£¬£¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞӦά³ÖÔÚ×îµÍÏ޶ȡ£¡£¡£¡£¡£
? ÆôÓÃÇ¿ÃÜÂëÕ½Êõ²¢ÉèÖÃΪ¶¨ÆÚÅú¸Ä¡£¡£¡£¡£¡£


3.4 ²Î¿¼Á´½Ó


https://www.msuiche.com/posts/detecting-cve-2025-43300-a-deep-dive-into-apples-dng-processing-vulnerability/
https://nvd.nist.gov/vuln/detail/CVE-2025-43300
https://thehackernews.com/2025/08/apple-patches-cve-2025-43300-zero-day.html/