CVE-2024-23296

Warning

EPSS 0.09%
Published 05.03.2024 20:16:01
Last modified 20.12.2024 16:51:47
Source product-security@apple.com
Teams watchlist Login
Open Login

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 17.4 and iPadOS 17.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.

Affected products Warnungen 1 Metrics 3 CWE 1 References 19

Data is provided by the National Vulnerability Database (NVD)

Apple ≫ iPad OS Version < 16.7.8

Apple ≫ iPad OS Version >= 17.0 < 17.4

Apple ≫ iPhone OS Version < 16.7.8

Apple ≫ iPhone OS Version >= 17.0 < 17.4

Apple ≫ macOS Version >= 12.0 < 12.7.6

Apple ≫ macOS Version >= 13.0 < 13.6.7

Apple ≫ macOS Version >= 14.0 < 14.4

Apple ≫ tvOS Version < 17.4

Apple ≫ visionOS Version < 1.1

Apple ≫ watchOS Version < 10.4

06.03.2024: CISA Known Exploited Vulnerabilities (KEV) Catalog

Apple Multiple Products Memory Corruption Vulnerability

Vulnerability

Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.

Description

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Required actions

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.09%	0.255

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H