CVE-2024-23296

Warnung

EPSS 0.09%
Veröffentlicht 05.03.2024 20:16:01
Zuletzt bearbeitet 20.12.2024 16:51:47
Quelle product-security@apple.com
Teams Watchlist Login
Unerledigt Login

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 17.4 and iPadOS 17.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.

Betroffene Produkte Warnungen 1 Metriken 3 CWE 1 Referenzen 19

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apple ≫ iPad OS Version < 16.7.8

Apple ≫ iPad OS Version >= 17.0 < 17.4

Apple ≫ iPhone OS Version < 16.7.8

Apple ≫ iPhone OS Version >= 17.0 < 17.4

Apple ≫ macOS Version >= 12.0 < 12.7.6

Apple ≫ macOS Version >= 13.0 < 13.6.7

Apple ≫ macOS Version >= 14.0 < 14.4

Apple ≫ tvOS Version < 17.4

Apple ≫ visionOS Version < 1.1

Apple ≫ watchOS Version < 10.4

06.03.2024: CISA Known Exploited Vulnerabilities (KEV) Catalog

Apple Multiple Products Memory Corruption Vulnerability

Schwachstelle

Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.

Beschreibung

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.09%	0.255

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H