A vulnerability classified as critical has been found in Apple macOS (Operating System). Affected is some unknown functionality of the component xar. The manipulation with an unknown input leads to a type confusion vulnerability. CWE is classifying the issue as CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was shared 12/13/2022 by Thijs Alkemade as HT213532 as confirmed advisory (Website). The advisory is shared for download at support.apple.com. This vulnerability is traded as CVE-2022-42841. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/12/2023). It is expected to see the exploit prices for this product increasing in the near future. The advisory points out:

Processing a maliciously crafted package may lead to arbitrary code execution

Upgrading to version 13.1 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability. The advisory contains the following remark:

A type confusion issue was addressed with improved checks.

Productinfo

Type

• Operating System

Vendor

• Apple

Name

• macOS

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion