iOS Vulnerability Fixes State Management Issue
CVE-2023-38606

5.5MEDIUM

Key Information:

Vendor: Apple
Status: tvOS; iOS and iPadOS; macOS; watchOS
Vendor: CVE Published:; 27 July 2023

Badges

📈 Trended👾 Exploit Exists🦅 CISA Reported📰 News Worthy

What is CVE-2023-38606?

CVE-2023-38606 is a vulnerability found in various Apple operating systems, including iOS, iPadOS, macOS, and tvOS. This flaw involves a state management issue that could permit an application to alter sensitive kernel states, potentially leading to unauthorized actions on the affected devices. Given the prevalence of Apple products in both personal and organizational environments, exploitation of this vulnerability could result in significant security risks, damaging the integrity and confidentiality of sensitive information.

Technical Details

The vulnerability relates to how state management is handled within the affected Apple operating systems. An app exploiting this vulnerability may gain the ability to modify kernel states, which could allow it to perform actions that it should not be permitted to execute. This issue has been addressed in various updates, including macOS Monterey 12.6.8, iOS 15.7.8, and other recent releases. The flaw is notable because it may have already seen active exploit attempts targeting versions of iOS prior to iOS 15.7.1.

Potential Impact of CVE-2023-38606

Unauthorized Access: Attackers could exploit this vulnerability to gain unauthorized control over device functions, which could lead to malicious activities such as data extraction or unauthorized network access.
Data Integrity Compromise: By enabling manipulation of kernel states, the vulnerability could allow malicious applications to interfere with system operations, potentially leading to data corruption or unauthorized alterations to critical files.
Increased Attack Surface: The existence of this vulnerability widens the attack surface for cybercriminals. With active exploitation reported, organizations using affected systems face heightened risks, necessitating urgent updates to mitigate potential breaches.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

iOS and iPadOS < 16.6

iOS and iPadOS < 15.7

macOS < 13.5

News Articles

The Record by Recorded Future

CVE-2023-38606

Spyware attack chain used previously unknown iPhone hardware feature, report says

Researchers at Kaspersky announced new information in their analysis of Operation Triangulation, a spyware campaign that targeted Russian iPhone users.

1 year ago