CVE-2024-23225:
Memory corruption vulnerability in Apple's kernel that could allow an attacker with arbitrary kernel read/write capability to bypass kernel memory protections. The issue was addressed with improved validation and fixed in iOS 16.7.6 / iPadOS 16.7.6 and iOS 17.4 / iPadOS 17.4, with Apple noting that the issue may have been exploited in the wild.
Score
A numerical rating that indicates how dangerous this vulnerability is.
7.8High- Published Date:Mar 5, 2024
- CISA KEV Date:Mar 6, 2024
- Industries Affected:20
1 DaysThreat Predictions
- EPSS Score:0.2
- EPSS Percentile:36%
Exploitability
- Score:1.8
- Attack Vector:LOCAL
- Attack Complexity:LOW
- Privileges Required:LOW
- User Interaction:NONE
- Scope:UNCHANGED
Impact
- Score:5.9
- Confidentiality Impact:HIGH
- Integrity Impact:HIGH
- Availability Impact:HIGH
Description Preview
Memory corruption vulnerability in Apple's kernel that could allow an attacker with arbitrary kernel read/write capability to bypass kernel memory protections. The issue was addressed with improved validation and fixed in iOS 16.7.6 / iPadOS 16.7.6 and iOS 17.4 / iPadOS 17.4, with Apple noting that the issue may have been exploited in the wild.
Overview
Apple vulnerabilities describe a kernel memory corruption issue where an attacker with arbitrary kernel read/write capability could bypass kernel memory protections. The issue was mitigated by improved validation and is fixed in iOS 16.7.6 / iPadOS 16.7.6 and in iOS 17.4 / iPadOS 17.4, with Apple acknowledging that it may have been exploited in the wild. The advisory indicates the impact is high and the attacker can operate with local access and low privileges, without user interaction.
Remediation
- Update affected devices to the fixed versions listed by Apple: iOS 16.7.6 or later and iPadOS 16.7.6 or later, or iOS 17.4 or later and iPadOS 17.4 or later.
- Enable automatic updates where possible and verify that devices have successfully installed the latest security updates.
- If devices cannot be updated immediately, apply any available interim mitigations from Apple advisories and monitor for additional guidance from Apple or CISA alerts.
- Develop and execute a patch management plan for all Apple platforms in use (macOS, tvOS, watchOS, VisionOS, etc.) as advised by Apple, ensuring upgrades are tested and deployed in a controlled manner.
- Educate users and administrators about the risk of kernel-level exploits and encourage prompt reboot/update after patches are released.
References
- - Apple Support: HT214081 (https://support.apple.com/en-us/HT214081)
- - Apple Support: HT214082 (https://support.apple.com/en-us/HT214082)
- - Apple Support: HT214083 (https://support.apple.com/kb/HT214083)
- - Apple Support: HT214088 (https://support.apple.com/kb/HT214088)
- - Apple Support: HT214084 (https://support.apple.com/kb/HT214084)
- - Apple Support: HT214086 (https://support.apple.com/kb/HT214086)
- - Apple Support: HT214085 (https://support.apple.com/kb/HT214085)
- - Apple Support: HT214087 (https://support.apple.com/kb/HT214087)
- - Full Disclosure (Mar 18, 2024) (http://seclists.org/fulldisclosure/2024/Mar/18)
- - Full Disclosure (Mar 19, 2024) (http://seclists.org/fulldisclosure/2024/Mar/19)
- - Full Disclosure (Mar 21, 2024) (http://seclists.org/fulldisclosure/2024/Mar/21)
- - Full Disclosure (Mar 22, 2024) (http://seclists.org/fulldisclosure/2024/Mar/22)
- - Full Disclosure (Mar 23, 2024) (http://seclists.org/fulldisclosure/2024/Mar/23)
- - Full Disclosure (Mar 24, 2024) (http://seclists.org/fulldisclosure/2024/Mar/24)
- - Full Disclosure (Mar 25, 2024) (http://seclists.org/fulldisclosure/2024/Mar/25)
- - Full Disclosure (Mar 26, 2024) (http://seclists.org/fulldisclosure/2024/Mar/26)
- - CISA Known Exploited Vulnerabilities Catalog: CVE-2024-23225 (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-23225)
Armis Early Warning
Armis Early Warning provides proactive threat intelligence and early detection capabilities.Click here to learn more.
- Armis Alert Date:Mar 5, 2024
- CISA KEV Date:Mar 6, 2024
- Days Early:1 Days
Industries Affected
Below is a list of industries most commonly impacted or potentially at risk based on intelligence.
