Apple iOS/iPadOS up to 16.4.1 WebKit use after free

Summaryinfo

A vulnerability classified as critical has been found in Apple iOS and iPadOS up to 16.4.1. This vulnerability affects unknown code of the component WebKit. The manipulation leads to use after free. This vulnerability is traded as CVE-2023-32373. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Apple iOS and iPadOS up to 16.4.1 (Smartphone Operating System). This issue affects some unknown processing of the component WebKit. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

The weakness was shared 05/18/2023 as HT213757 as confirmed advisory (Website). The advisory is shared at support.apple.com. The identification of this vulnerability is CVE-2023-32373. It demands that the victim is doing some kind of user interaction. Technical details are unknown but an exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 01/01/2026). It is expected to see the exploit prices for this product increasing in the near future. The advisory points out:

Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

It is declared as attacked. The vulnerability scanner Nessus provides a plugin with the ID 212173 (Apple Safari 16.5 Multiple Vulnerabilities (102735)), which helps to determine the existence of the flaw in a target environment. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 05/22/2023 with a due date of 06/12/2023:

Apply updates per vendor instructions.

Upgrading to version 16.5 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability. The advisory contains the following remark:

A use-after-free issue was addressed with improved memory management.

The vulnerability is also documented in the databases at Zero-Day.cz (769), Tenable (212173) and EUVD (EUVD-2023-36617). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Apple

Name

• iOS
• iPadOS

Version

• 16.4.0
• 16.4.1

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion