Apple released a new HomeView Software 27.2 build on November 12, a day before the 7-inch HomeView smart display went on sale on. The update patches nine security vulnerabilities, including two that could let someone within Bluetooth range pair with the device without any action from you.
The new build is numbered 24V526 and follows an earlier 27.2 release from October 30 that included the 20 HomeView wallpapers. Apple has not announced any other changes, so the nine security fixes it published on November 12 are the only confirmed ones.
HomeView Software 27.2 Security Fixes
Five of the fixes harden how the HomeView connects to nearby devices, and the other four cover app data, memory handling and iMessage groups. Apple found four of the five connection issues itself.
Pairing and Bluetooth
- A malicious Bluetooth device could establish a pairing with the HomeView without any user interaction.
- An attacker within Bluetooth range could bypass the pairing code rate limit and pair with the device without user interaction. An anonymous researcher reported the pairing code bypass.
- Another attacker within Bluetooth range could bypass the rate limit on pairing code attempts through AirPlay.
- An attacker on the same network could bypass the rate limit on AirPlay pairing code attempts through rapportd.
- A use-after-free bug in Bluetooth could let an attacker within range corrupt process memory.
Data and iMessage
- An authorization issue in App Intents could let an app access sensitive user data, and researcher László Várady reported it.
- An out-of-bounds write in the brotli compression library could cause memory corruption when the HomeView processed maliciously crafted input.
- A remote attacker could join an iMessage group chat and receive its messages.
- A person added to an iMessage group could read messages sent before they joined, and Apple fixed that one by removing the vulnerable code.
Siri Fix Due in December
Apple confirmed a separate HomeView software update for December that fixes two Siri AI problems found in early HomeView reviews. Siri AI refused to unlock a front door or open a garage door by voice for journalist Joanna Stern, even though the HomeView recognized her, and it once told her the device has no camera.
Until the update arrives, you can unlock door locks and garage doors by opening the Home app on the HomeView and tapping the on-screen controls. Apple told Stern that recognized users can already unlock security accessories on the HomeView screen, and the update will extend that to Siri AI once the device has recognized the person asking.
Apple waited for Siri AI before launching the HomeView, and Siri AI handles voice commands for the smart home accessories connected to the device. Apple has not given a day or a version number for the December update.
