HIGH

CVE-2022-32917

Apple Ipados 2022-09-20 CVSS v3.1

CVSS

7.8

KEV

Description

The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..

Summary dbcve.org

A kernel-level privilege escalation vulnerability in multiple Apple operating systems (macOS Monterey, Big Sur, iOS, iPadOS). The fix involved improved bounds checks, indicating a buffer overflow or out-of-bounds memory access flaw that allows a local application to execute arbitrary code with kernel privileges. This was actively exploited as a zero-day.

Mitigation

Apply the appropriate vendor security update: macOS Monterey 12.6, macOS Big Sur 11.7, iOS 15.7/16, or iPadOS 15.7. This is critical as the vulnerability is being actively exploited in the wild.

Weakness (CWE)

CWE-787 Out-of-bounds Write

EPSS Score

5.6%

Probability of exploitation in next 30 days

92.6th percentile

References

http://seclists.org/fulldisclosure/2022/Oct/39 Mailing List, Third Party Advisory http://seclists.org/fulldisclosure/2022/Oct/40 Mailing List, Third Party Advisory http://seclists.org/fulldisclosure/2022/Oct/43 Mailing List, Third Party Advisory http://seclists.org/fulldisclosure/2022/Oct/45 Mailing List, Third Party Advisory https://support.apple.com/en-us/HT213443 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT213444 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT213445 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT213446 Release Notes, Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-32917 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE