CVE-2022-22674
Apple macOS Out-of-Bounds Read Vulnerability
Description
CVE-2022-22674 is an out-of-bounds read vulnerability in the Intel Graphics Driver on macOS Monterey that allows an application to read kernel memory. This information disclosure vulnerability can be used to bypass kernel address space layout randomization (KASLR) and aid in the exploitation of other kernel vulnerabilities. It was actively exploited as a zero-day and added to CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.1% (52nd percentile) reflects the targeted nature of exploitation typical of Apple zero-day chains.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | mac os x | >= 10.15, < 10.15.7; 10.15.7 |
| apple | macos | >= 11.0, < 11.6.6; >= 12.0.0, < 12.3.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://support.apple.com/en-us/HT213220(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213255(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213256(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22674(Third Party Advisory, US Government Resource)
Weakness Type
CWE-125: Out-of-bounds Read
An out-of-bounds read occurs when a program reads data past the end or before the beginning of a buffer, potentially exposing sensitive information stored in adjacent memory. In CVE-2022-22674, the Intel Graphics Driver reads beyond buffer boundaries, leaking kernel memory contents that can reveal critical addresses and data. For more details, see CWE-125.
Impact Analysis
While this vulnerability is classified as an information disclosure rather than direct code execution, its practical impact is significant when used as part of an exploit chain. Kernel memory disclosure allows attackers to defeat KASLR, a critical defense mechanism that randomizes the kernel's memory layout to prevent exploitation of other vulnerabilities. By leaking kernel memory addresses, this vulnerability serves as a reliable stepping stone for achieving full kernel compromise. When combined with a kernel write vulnerability such as CVE-2022-22675, the pair provides a complete exploit chain from user-space to kernel-level code execution.
Exploit Maturity
CVE-2022-22674 was actively exploited as a zero-day vulnerability and was added to CISA's KEV catalog on April 4, 2022, alongside CVE-2022-22675. Apple acknowledged the active exploitation in its security advisory. The low EPSS score of 0.1% (52nd percentile) is characteristic of Apple zero-day vulnerabilities, which are typically exploited by sophisticated threat actors in highly targeted campaigns rather than mass exploitation. The vulnerability was likely used as part of a multi-stage exploit chain for complete system compromise.
Remediation
- Update macOS Monterey to version 12.3.1 or later, which resolves the Intel Graphics Driver vulnerability, as required by CISA's KEV catalog.
- Enable automatic macOS updates to ensure timely application of security patches.
- Deploy endpoint detection and response (EDR) solutions that can monitor for kernel memory access anomalies on macOS systems.
- Consider implementing additional kernel hardening measures available through macOS security configurations.
- Review systems for indicators of compromise, particularly evidence of exploit chains combining information disclosure with privilege escalation.
Technical Details
The vulnerability resides in the Intel Graphics Driver (kext) on macOS Monterey, which processes graphics-related operations at the kernel level. Due to insufficient bounds checking, certain driver operations read data beyond the allocated buffer boundaries, exposing adjacent kernel memory contents to user-space applications. An attacker can trigger these out-of-bounds reads through specific graphics API calls to reliably leak kernel memory addresses, effectively defeating KASLR. The leaked addresses provide the necessary information to craft reliable exploits for kernel write vulnerabilities by allowing precise targeting of kernel data structures and function pointers.
Frequently Asked Questions
What is CVE-2022-22674?
CVE-2022-22674 is an out-of-bounds read vulnerability in the Intel Graphics Driver on macOS Monterey. It allows applications to read kernel memory, which can be used to defeat kernel security protections like KASLR and assist in exploiting other vulnerabilities.
How is this related to CVE-2022-22675?
Both vulnerabilities were disclosed and patched together in macOS Monterey 12.3.1 and were both actively exploited as zero-days. CVE-2022-22674 (information disclosure) likely served as the first stage of an exploit chain, with CVE-2022-22675 (kernel code execution via AppleAVD) as the second stage.
Is an information disclosure vulnerability really dangerous?
Yes, particularly in the context of kernel exploitation. KASLR is a fundamental security mechanism that randomizes the kernel's memory addresses. Without knowing these addresses, exploiting other kernel vulnerabilities becomes significantly harder. This vulnerability provides the information needed to make other exploits reliable.
Does this affect Intel and Apple Silicon Macs?
As the name suggests, this vulnerability specifically affects the Intel Graphics Driver, which is present on Intel-based Mac systems running macOS Monterey. Apple Silicon Macs use different graphics drivers and may not be affected by this specific vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.