CVE-2023-38606KEV · OVERDUE

Apple Multiple Products Kernel Unspecified Vulnerability

Medium · published July 26, 2023

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 5.5. It is confirmed in active exploitation. It sits in the 86.8th percentile for exploit probability.

1166
days past CISA
deadline
CVSS v3.1
5.5
EPSS
3%
Percentile
86.8
In the wild
Confirmed
What it is

🚨 Sensitive kernel state can be modified by an app! This is a serious vulnerability that Apple has acknowledged may have been actively exploited. ⚠️ Think of it like a restaurant where a sneaky waiter can tamper with the kitchen's order system, changing food orders without anyone knowing. If the kitchen isn't careful, they might whip up something unexpected—and not in a good way! An attacker could potentially manipulate critical parts of your device's operating system, leading to unauthorized access or actions that compromise your data and privacy. Such exploitation could be absolutely devastating, especially if you’re running older versions of iOS!

Put simply

Think of it like a restaurant where a sneaky waiter can tamper with the kitchen's order system, changing food orders without anyone knowing. If the kitchen isn't careful, they might whip up something unexpected—and not in a good way! This vulnerability arises from improper state management, allowing apps to alter sensitive kernel state without proper checks. It's like having a door that should only be opened by authorized personnel—but anyone can slip through!

What to do

An attacker could potentially manipulate critical parts of your device's operating system, leading to unauthorized access or actions that compromise your data and privacy. Such exploitation could be absolutely devastating, especially if you’re running older versions of iOS! To protect yourself, update your devices immediately to at least macOS Monterey 12.6.8, iOS 15.7.8, or later versions as specified. Regularly check for updates and enable auto-update features to stay secure! You've got this! Follow these steps, and you'll have your device locked down in no time! 🛡️

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.02899 · 86.8th percentile
Published
2023-07-26T23:55Z
KEV added
2023-07-26 · due 2023-08-16
EPSS history
Timeline
  • 26 JUL 23:55Z
    This issue was addressed with improved state management
    cvelistv5
  • 26 JUL 00:00Z
    Added to CISA KEV — remediate by Aug 16
    kev