Apple iOS/iPadOS up to 17.3 Kernel Memory memory corruption

Summaryinfo

A vulnerability categorized as critical has been discovered in Apple iOS and iPadOS up to 17.3. This affects an unknown function of the component Kernel Memory Handler. Executing a manipulation can lead to memory corruption. This vulnerability is tracked as CVE-2024-23296. The attack is restricted to local execution. Moreover, an exploit is present. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Apple iOS and iPadOS up to 17.3 (Smartphone Operating System) and classified as critical. This vulnerability affects an unknown functionality of the component Kernel Memory Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.6, macOS Sonoma 14.4, macOS Ventura 13.6.7, tvOS 17.4, visionOS 1.1, watchOS 10.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.

The weakness was disclosed 03/05/2024 as HT214081. The advisory is available at support.apple.com. This vulnerability was named CVE-2024-23296 since 01/12/2024. Technical details are unknown but an exploit is available. The structure of the vulnerability defines a possible price range of USD $5k-$25k at the moment (estimation calculated on 04/03/2026). It is expected to see the exploit prices for this product increasing in the near future.

It is declared as attacked. The vulnerability scanner Nessus provides a plugin with the ID 214269 (macOS 13.x < 13.6.7 Multiple Vulnerabilities (120900)), which helps to determine the existence of the flaw in a target environment. This issue was added on 03/06/2024 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 03/27/2024:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Upgrading to version 17.4 eliminates this vulnerability.

The vulnerability is also documented in the databases at Zero-Day.cz (870) and Tenable (214269). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Smartphone Operating System

Vendor

• Apple

Name

• iOS
• iPadOS

Version

• 17.0
• 17.1
• 17.2
• 17.3

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion