7.8

CVE-2024-23225

Warnung
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5, tvOS 17.4, visionOS 1.1, watchOS 10.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apple ≫ iPadOS Version < 16.7.6
Apple ≫ iPadOS Version >= 17.0 < 17.4
Apple ≫ iPhone OS Version < 16.7.6
Apple ≫ iPhone OS Version >= 17.0 < 17.4
Apple ≫ macOS Version >= 12.0 < 12.7.4
Apple ≫ macOS Version >= 13.0 < 13.6.5
Apple ≫ macOS Version >= 14.0 < 14.4
Apple ≫ tvOS Version < 17.4
Apple ≫ visionOS Version < 1.1
Apple ≫ watchOS Version < 10.4

06.03.2024: CISA Known Exploited Vulnerabilities (KEV) Catalog

Apple Multiple Products Memory Corruption Vulnerability

Schwachstelle

Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.

Beschreibung

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.48% 0.706
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

http://seclists.org/fulldisclosure/2024/Mar/21
Third Party Advisory
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/24
Third Party Advisory
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/25
Third Party Advisory
Mailing List
https://support.apple.com/kb/HT214084
Vendor Advisory
https://support.apple.com/kb/HT214086
Vendor Advisory
https://support.apple.com/kb/HT214088
Vendor Advisory
http://seclists.org/fulldisclosure/2024/Mar/22
Third Party Advisory
Mailing List
https://support.apple.com/kb/HT214082
Vendor Advisory
https://support.apple.com/kb/HT214085
Vendor Advisory
http://seclists.org/fulldisclosure/2024/Mar/23
Third Party Advisory
Mailing List
https://support.apple.com/kb/HT214083
Vendor Advisory
http://seclists.org/fulldisclosure/2024/Mar/18
Third Party Advisory
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/19
Third Party Advisory
Mailing List
http://seclists.org/fulldisclosure/2024/Mar/26
Third Party Advisory
Mailing List
https://support.apple.com/en-us/HT214081
Vendor Advisory
https://support.apple.com/en-us/HT214082
Vendor Advisory
https://support.apple.com/kb/HT214087
Vendor Advisory
https://support.apple.com/en-us/120881
Vendor Advisory
Release Notes
https://support.apple.com/en-us/120882
Vendor Advisory
Release Notes
https://support.apple.com/en-us/120883
Vendor Advisory
Release Notes
https://support.apple.com/en-us/120893
Vendor Advisory
Release Notes
https://support.apple.com/en-us/120895
Vendor Advisory
Release Notes
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23225
US Government Resource
https://support.apple.com/en-us/120880
Vendor Advisory
Release Notes
https://support.apple.com/en-us/120886
Vendor Advisory
Release Notes
https://support.apple.com/en-us/120884
Vendor Advisory
Release Notes