CVE-2023-42824
Vulnerability from cvelistv5
Published
2023-10-04 18:02
Modified
2024-08-02 19:30
Severity ?
EPSS score ?
Summary
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.
References
▼ | URL | Tags | |
---|---|---|---|
product-security@apple.com | https://support.apple.com/en-us/HT213972 | Release Notes, Vendor Advisory |
Impacted products
▼ | Vendor | Product |
---|---|---|
Apple | iOS and iPadOS |
CISA Known exploited vulnerability
Data from the Known Exploited Vulnerabilities Catalog
Date added: 2023-10-05
Due date: 2023-10-26
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Used in ransomware: Unknown
Notes: https://support.apple.com/en-us/HT213961; https://nvd.nist.gov/vuln/detail/CVE-2023-42824
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T19:30:24.664Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://support.apple.com/en-us/HT213972" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "iOS and iPadOS", "vendor": "Apple", "versions": [ { "lessThan": "16.7", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6." } ], "problemTypes": [ { "descriptions": [ { "description": "A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.", "lang": "en" } ] } ], "providerMetadata": { "dateUpdated": "2023-10-25T18:32:11.941Z", "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple" }, "references": [ { "url": "https://support.apple.com/en-us/HT213972" } ] } }, "cveMetadata": { "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "assignerShortName": "apple", "cveId": "CVE-2023-42824", "datePublished": "2023-10-04T18:02:20.884Z", "dateReserved": "2023-09-14T19:05:11.447Z", "dateUpdated": "2024-08-02T19:30:24.664Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "cisa_known_exploited": { "cveID": "CVE-2023-42824", "dateAdded": "2023-10-05", "dueDate": "2023-10-26", "knownRansomwareCampaignUse": "Unknown", "notes": "https://support.apple.com/en-us/HT213961; https://nvd.nist.gov/vuln/detail/CVE-2023-42824", "product": "iOS and iPadOS", "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "shortDescription": "Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation.", "vendorProject": "Apple", "vulnerabilityName": "Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability" }, "nvd": "{\"cve\":{\"id\":\"CVE-2023-42824\",\"sourceIdentifier\":\"product-security@apple.com\",\"published\":\"2023-10-04T19:15:10.490\",\"lastModified\":\"2023-10-26T20:01:18.743\",\"vulnStatus\":\"Analyzed\",\"cisaExploitAdd\":\"2023-10-05\",\"cisaActionDue\":\"2023-10-26\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.\"},{\"lang\":\"es\",\"value\":\"El problema se solucion\u00f3 con controles mejorados. Este problema se solucion\u00f3 en iOS 16.7.1 y iPadOS 16.7.1. Un atacante local podr\u00eda aumentar sus privilegios. Apple tiene conocimiento de un informe que indica que este problema puede haber sido explotado activamente en versiones de iOS anteriores a iOS 16.6.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"16.7.1\",\"matchCriteriaId\":\"EDDE4794-A831-4132-910D-AF5714964F39\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.0\",\"versionEndExcluding\":\"17.0.3\",\"matchCriteriaId\":\"5383A8BF-7AD6-4D5A-9B57-DE1BC2C59E09\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"16.7.1\",\"matchCriteriaId\":\"52D04CC0-37F2-4214-9B91-8FA97E856210\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.0\",\"versionEndExcluding\":\"17.0.3\",\"matchCriteriaId\":\"F1D28032-F9E6-45E7-98B6-7CE2351C4C99\"}]}]}],\"references\":[{\"url\":\"https://support.apple.com/en-us/HT213972\",\"source\":\"product-security@apple.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]}]}}" } }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.