Actively exploited · Published Sep 20, 2022 · Assigned by apple
CVE-2022-32917
High 7.8 Exploited
In plain English
A high-severity out-of-bounds write in iOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on September 14, 2022). The chance it is exploited in the next 30 days is estimated at 5.6% (higher than 93% of all known vulnerabilities). Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Oct 5, 2022.
Official description
The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
Affected products (as reported)
Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT213446
- https://support.apple.com/en-us/HT213443
- https://support.apple.com/en-us/HT213445
- https://support.apple.com/en-us/HT213444
- 20221030 APPLE-SA-2022-10-27-3 Additional information for APPLE-SA-2022-09-12-1 iOS 16 mailing-list
- 20221030 APPLE-SA-2022-10-27-4 Additional information for APPLE-SA-2022-09-12-2 iOS 15.7 and iPadOS 15.7 mailing-list
- 20221030 APPLE-SA-2022-10-27-7 Additional information for APPLE-SA-2022-09-12-4 macOS Monterey 12.6 mailing-list
- 20221030 APPLE-SA-2022-10-27-9 Additional information for APPLE-SA-2022-09-12-3 macOS Big Sur 11.7 mailing-list
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-32917 government-resource