CVE-2024-23225KEV · OVERDUE

Apple Multiple Products Memory Corruption Vulnerability

High · published March 5, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 73.7th percentile for exploit probability.

942
days past CISA
deadline
CVSS v3.1
7.8
EPSS
1%
Percentile
73.7
In the wild
Confirmed
What it is

🚨 A sneaky memory corruption issue in Apple products could let mischief-makers read and write kernel memory like it’s a public library! ⚡ Think of your device as a highly secretive vault. If a thief finds an unlocked side door, they could rummage through sensitive documents without anyone noticing—exactly what this vulnerability allows! An attacker could potentially bypass kernel memory protections, gaining access to sensitive information and executing malicious actions with elevated privileges. This could lead to anything from data leaks to complete system compromise, making it absolutely devastating!

Put simply

Think of your device as a highly secretive vault. If a thief finds an unlocked side door, they could rummage through sensitive documents without anyone noticing—exactly what this vulnerability allows! This memory corruption flaw allows attackers with arbitrary kernel read and write capability to bypass critical protections in Apple’s operating systems, compromising security. Essentially, it was a failure in validating memory access requests that led to this vulnerability.

What to do

An attacker could potentially bypass kernel memory protections, gaining access to sensitive information and executing malicious actions with elevated privileges. This could lead to anything from data leaks to complete system compromise, making it absolutely devastating! Immediate action is essential! Update your devices to iOS 16.7.6, iPadOS 16.7.6, macOS Monterey 12.7.4, or the latest versions as recommended. Keeping your systems patched is the key to thwarting this threat! 🔥 You've got this! With these updates, you're one step closer to ensuring your devices are safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01481 · 73.7th percentile
Published
2024-03-05T19:24Z
KEV added
2024-03-06 · due 2024-03-27
EPSS history
Timeline
  • 06 MAR 00:00Z
    Added to CISA KEV — remediate by Mar 27
    kev
  • 05 MAR 19:24Z
    A memory corruption issue was addressed with improved validation
    cvelistv5