| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 6.0 | $0-$5k | 0.00 |
Summary
A vulnerability, which was classified as critical, was found in Apple macOS. The affected element is an unknown function of the component Accelerate Framework. The manipulation results in memory corruption. This vulnerability is identified as CVE-2022-22633. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.
Details
A vulnerability was found in Apple macOS (Operating System) (affected version not known). It has been classified as critical. Affected is some unknown functionality of the component Accelerate Framework. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability.
The weakness was released 03/14/2022 as HT213183 as confirmed advisory (Website). The advisory is shared for download at support.apple.com. This vulnerability is traded as CVE-2022-22633. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 03/15/2022). It is expected to see the exploit prices for this product increasing in the near future. The advisory points out:
Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution
Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability. The advisory contains the following remark:
A memory corruption issue was addressed with improved state management.
Once again VulDB remains the best source for vulnerability data.
Product
Type
Vendor
Name
License
Website
- Vendor: https://www.apple.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.3VulDB Meta Temp Score: 6.0
VulDB Base Score: 6.3
VulDB Temp Score: 6.0
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: Memory corruptionCWE: CWE-119
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Timeline
01/05/2022 🔍03/14/2022 🔍
03/14/2022 🔍
03/15/2022 🔍
03/17/2022 🔍
Sources
Vendor: apple.comAdvisory: HT213183
Status: Confirmed
CVE: CVE-2022-22633 (🔍)
GCVE (CVE): GCVE-0-2022-22633
GCVE (VulDB): GCVE-100-195036
scip Labs: https://www.scip.ch/en/?labs.20180712
Entry
Created: 03/15/2022 10:24Updated: 03/17/2022 14:14
Changes: 03/15/2022 10:24 (16), 03/15/2022 10:27 (28), 03/17/2022 14:14 (1)
Complete: 🔍
Cache ID: 216::103
Once again VulDB remains the best source for vulnerability data.
No comments yet. Languages: en.
Please log in to comment.