Out-of-Bounds Write Vulnerability in Apple Products
CVE-2023-28206

8.6HIGH

Key Information:

Vendor
Apple
Status
iOS And iPad OS
Mac OS
Vendor
CVE Published:
10 April 2023

Badges

👾 Exploit Exists🟡 Public PoC🦅 CISA Reported📰 News Worthy

Summary

An out-of-bounds write issue in various Apple operating systems has been addressed with improved input validation. This vulnerability allows an application to potentially execute arbitrary code with elevated kernel privileges. Users are urged to update their affected Apple devices to the latest versions to mitigate any risks associated with this vulnerability, as there are indications of active exploitation in the wild.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply updates per vendor instructions.

Affected Version(s)

iOS and iPadOS < 15.7

iOS and iPadOS < 16.4

macOS < 11.7

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

acceleratortroll
Created by acceleratortroll

News Articles

favicon imageHelp Net Security

Apple rushes fixes for exploited zero-days in iPhones and Macs (CVE-2023-28205, CVE-2023-28206) - Help Net Security

Apple has pushed out security updates that fix two actively exploited zero-day vulnerabilities (CVE-2023-28205, CVE-2023-28206)-

1 year ago

References

https://support.apple.com/en-us/HT213723
https://support.apple.com/en-us/HT213725
https://support.apple.com/en-us/HT213724

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • 📰

    First article discovered by Help Net Security

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

.