CVE-2023-41992

Published Sep 21, 2023

Last updated 4 months ago

Exploit known CVSS high 7.8

Apple

macOS

iOS

iPadOS

Overview

AI description

Automated description summarized from trusted sources.

CVE-2023-41992 is a vulnerability affecting Apple's macOS Monterey, iOS, iPadOS, and macOS Ventura. It involves an unspecified issue that can be exploited by a local attacker to elevate their privileges on the system. The vulnerability was addressed by Apple with improved checks in the updated versions of the operating systems, specifically macOS Monterey 12.7, iOS 16.7, iPadOS 16.7, and macOS Ventura 13.6. There are reports indicating that this vulnerability may have been actively exploited in earlier versions of iOS before the release of iOS 16.7.

Description: The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
Source: product-security@apple.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Apple Multiple Products Kernel Privilege Escalation Vulnerability
Exploit added on: Sep 25, 2023
Exploit action due: Oct 16, 2023
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov: CWE-754
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-754

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1CEB5BA1-7092-4ADE-B19F-FD34CB53CCC3",
            "versionEndExcluding": "16.7"
          },
          {
            "criteria": "cpe:2.3:o:apple:ipados:17.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FD0EE39C-DEC4-475C-8661-5BD76457A39E"
          },
          {
            "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3FC8EB94-1D4F-4CE8-83D0-9086D1EBBC8F",
            "versionEndExcluding": "16.7"
          },
          {
            "criteria": "cpe:2.3:o:apple:iphone_os:17.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "502CD624-FA22-4C7B-9CA3-53CA938BE1AB"
          },
          {
            "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F05757BB-26B5-40A5-B37C-577706EA11C8",
            "versionEndExcluding": "12.7",
            "versionStartIncluding": "12.0"
          },
          {
            "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7A78DA60-AE3B-4B3C-B338-97DAFABEBB1F",
            "versionEndExcluding": "13.6",
            "versionStartIncluding": "13.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.