CVE-2022-32917
Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability
Description
CVE-2022-32917 is a remote code execution vulnerability in the Apple kernel affecting iOS, iPadOS, and macOS that allows an application to execute arbitrary code with kernel privileges. The vulnerability exists in the Apple kernel and enables complete device compromise through a malicious application. CISA added CVE-2022-32917 to the KEV catalog on September 14, 2022. While the EPSS score of 0.52% (66.60th percentile) indicates moderate exploitation probability, Apple has confirmed active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 15.7 |
| apple | iphone os | < 15.7 |
| apple | macos | >= 11.0, < 11.7; >= 12.0.0, < 12.6 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://seclists.org/fulldisclosure/2022/Oct/39(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2022/Oct/40(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2022/Oct/43(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2022/Oct/45(Mailing List, Third Party Advisory)
- https://support.apple.com/en-us/HT213443(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213444(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213445(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213446(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-32917(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CVE-2022-32917 is attributed to improper input validation in the Apple kernel. The kernel fails to adequately validate certain inputs, allowing a malicious application to escape its sandbox and execute code with kernel-level privileges, bypassing all security boundaries on the device.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2022-32917 enables kernel-level code execution on Apple iOS, iPadOS, and macOS devices through a malicious application. The vulnerability allows complete bypass of the iOS/macOS security model, including application sandboxing and code signing enforcement. Confidentiality is critically impacted as kernel access exposes all data on the device including encrypted content, passwords, and biometric data. Integrity is compromised through the ability to modify any system component or install persistent backdoors. Availability can be affected by destabilizing the kernel. The confirmed in-the-wild exploitation suggests targeted use, potentially by surveillance or state-sponsored threat actors.
Exploit Maturity
CISA confirmed active exploitation of CVE-2022-32917 and added it to the KEV catalog on September 14, 2022, with a remediation deadline of October 5, 2022. Apple confirmed that this vulnerability may have been actively exploited in the wild. The EPSS score of 0.52% (66.60th percentile) suggests limited mass exploitation, but the confirmed in-the-wild usage indicates targeted attacks, likely by sophisticated threat actors. Apple kernel vulnerabilities are commonly used in commercial spyware and surveillance tools. The ransomware association is classified as unknown.
Remediation
- Update Apple devices immediately: Install iOS 16, iPadOS 16, and macOS Ventura or the latest security updates for iOS 15.7 and macOS Monterey 12.6 that address this vulnerability.
- Enable automatic updates: Configure all managed Apple devices for automatic security updates to reduce the window of exposure.
- Deploy mobile device management: Use MDM to enforce OS version requirements and verify that all managed devices are running patched versions.
- Enable Lockdown Mode: For high-risk users, enable Apple's Lockdown Mode feature which restricts attack surface for advanced targeted attacks.
- Monitor for device anomalies: Watch for unusual battery drain, unexpected reboots, or other signs that may indicate kernel exploitation on managed devices.
Technical Details
CVE-2022-32917 exists in the Apple kernel, which is the core operating system component shared across iOS, iPadOS, and macOS. The vulnerability allows a malicious application to execute code with kernel privileges, effectively escaping the application sandbox and gaining complete control over the device. Apple addressed the issue with improved bounds checking, suggesting the vulnerability involves an out-of-bounds memory access in kernel code that can be triggered from a user-space application. The attack requires the user to install or run a malicious application, which could be delivered through social engineering, compromised app stores, or enterprise deployment profiles. Once kernel code execution is achieved, the attacker has unrestricted access to the device.
Frequently Asked Questions
Is CVE-2022-32917 being actively exploited?
Yes, Apple has confirmed that CVE-2022-32917 may have been actively exploited. CISA added it to the KEV catalog on September 14, 2022. The vulnerability is likely used in targeted attacks by sophisticated threat actors.
What products are affected by CVE-2022-32917?
CVE-2022-32917 affects the Apple kernel in iOS, iPadOS, and macOS. Devices running versions prior to iOS 16, iPadOS 16, macOS Ventura, iOS 15.7, and macOS 12.6 are vulnerable.
How do I fix CVE-2022-32917?
Update all Apple devices to the latest available operating system versions. Enable automatic security updates and consider Lockdown Mode for high-risk users.
How severe is CVE-2022-32917?
CVE-2022-32917 enables kernel-level code execution on Apple devices, which represents complete device compromise. While the EPSS score of 0.52% suggests limited mass exploitation, the confirmed in-the-wild usage makes it a critical concern for targeted attack scenarios.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.