CVE-2022-42827KEV · OVERDUE

Apple iOS and iPadOS Out-of-Bounds Write Vulnerability

High · published November 1, 2022

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 64.5th percentile for exploit probability.

1438
days past CISA
deadline
CVSS v3.1
7.8
EPSS
1%
Percentile
64.5
In the wild
Confirmed
What it is

🚨 An out-of-bounds write in iOS and iPadOS could let attackers run wild with kernel privileges — that's like finding a spare key to the server room and throwing a rave inside! 🔥 Think of this vulnerability as a waiter who accidentally opens a door to a restricted kitchen area while serving meals, unwittingly letting in anyone who wants to wreak havoc. When bounds aren't checked, it's like leaving the back door unlocked during a busy shift — chaos can ensue! An attacker could potentially execute arbitrary code with kernel privileges, leading to full control over the device. This could mean stealing sensitive information, installing malware, or causing system instability — a nightmare scenario for any user!

Put simply

Think of this vulnerability as a waiter who accidentally opens a door to a restricted kitchen area while serving meals, unwittingly letting in anyone who wants to wreak havoc. When bounds aren't checked, it's like leaving the back door unlocked during a busy shift — chaos can ensue! This out-of-bounds write issue allows applications to manipulate memory outside their allocated space, risking arbitrary code execution with high privileges. Apple has patched this in versions 15.7.1 and 16.1 for both iOS and iPadOS.

What to do

An attacker could potentially execute arbitrary code with kernel privileges, leading to full control over the device. This could mean stealing sensitive information, installing malware, or causing system instability — a nightmare scenario for any user! Update your devices immediately to iOS 15.7.1 or 16.1, or iPadOS 15.7.1 or 16 to close this vulnerability. Regularly check for updates to ensure you have the latest security patches and monitor your device for unusual activity. You've got this! With these updates, you'll secure your devices and keep the hackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01066 · 64.5th percentile
Published
2022-11-01T00:00Z
KEV added
2022-10-25 · due 2022-11-15
EPSS history
Timeline
  • 01 NOV 00:00Z
    An out-of-bounds write issue was addressed with improved bounds checking
    cvelistv5
  • 25 OCT 00:00Z
    Added to CISA KEV — remediate by Nov 15
    kev