CVE-2022-48618
Apple Multiple Products Memory Corruption Vulnerability
Description
CVE-2022-48618 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability affecting multiple Apple products, including iOS, iPadOS, macOS Ventura, tvOS, and watchOS. The flaw resides in Pointer Authentication — a hardware security feature designed to protect against memory corruption attacks — and allows an attacker who already has arbitrary read and write capability to bypass this protection mechanism. Successful exploitation could lead to full compromise of the device, including access to sensitive data, modification of system integrity, and disruption of availability. CISA has added CVE-2022-48618 to its Known Exploited Vulnerabilities catalog, with Apple confirming reports that this issue was exploited against versions of iOS released before iOS 15.7.1.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 16.2 |
| apple | iphone os | < 16.2 |
| apple | macos | >= 13.0, < 13.1 |
| apple | tvos | < 16.2 |
| apple | watchos | < 9.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT213530(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213532(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213535(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213536(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-48618(US Government Resource)
Weakness Type
CWE-367: Time-of-Check Time-of-Use (TOCTOU) Race Condition
CVE-2022-48618 exploits a TOCTOU race condition in Apple's Pointer Authentication implementation, where a security check is performed and then a subsequent use of the resource occurs in a window that can be manipulated by an attacker. In the context of Apple's operating systems, this means an attacker with existing read/write access can race the Pointer Authentication validation to substitute a valid pointer with a crafted one, bypassing a critical kernel-level security boundary.
Learn more: CWE-367 — Time-of-Check Time-of-Use (TOCTOU) Race Condition
Impact Analysis
CVE-2022-48618 carries a CVSS score of 7.0 (HIGH) with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Attack Vector (Local): exploitation requires local access to the device, meaning the attacker must already have some foothold on the target system. Attack Complexity (High): the race condition nature of the vulnerability means exploitation requires precise timing and is not trivially reproducible on demand. Privileges Required (Low): the attacker must possess at least some level of authenticated access to the device. Despite these constraints, Confidentiality (High), Integrity (High), and Availability (High) impacts make the potential consequences severe — a successful exploit could expose all data on the device, allow arbitrary code execution at elevated privilege levels, and fully compromise system availability. The inclusion of this vulnerability in the CISA KEV catalog confirms it has been exploited in the wild against real targets.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-48618 in the wild by adding it to the Known Exploited Vulnerabilities catalog, and Apple has acknowledged reports of exploitation against versions of iOS released before iOS 15.7.1. No references tagged as public exploit code or PoC are listed in the available references for this CVE. With an EPSS score of approximately 0.17%, broad automated exploitation is not currently predicted to be widespread, though the confirmed in-the-wild use against targeted Apple devices makes this vulnerability a significant concern for high-value targets. Organizations and individuals using unpatched Apple devices should treat this as a high-priority remediation item.
Remediation
- Apply vendor-supplied patches immediately: Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Update all affected Apple products to the patched versions: Install macOS Ventura 13.1 or later, iOS 16.2 and iPadOS 16.2 or later, tvOS 16.2 or later, and watchOS 9.2 or later — these releases contain the fix for CVE-2022-48618.
- Prioritize devices running iOS versions prior to 15.7.1: Apple confirmed exploitation occurred on older iOS versions; ensure all managed devices are on a supported and patched release.
- Enable automatic security updates on all Apple devices to reduce the window of exposure for future vulnerabilities exploited in the wild.
- Review device access logs and anomalous privilege escalation events for indicators of compromise, particularly on devices that were running pre-15.7.1 iOS versions during the period this vulnerability was being exploited.
Technical Details
CVE-2022-48618 is rooted in a Time-of-Check Time-of-Use (TOCTOU) race condition within Apple's Pointer Authentication Code (PAC) implementation — a hardware-enforced defense mechanism present in ARM processors that cryptographically signs pointers to detect and prevent their modification. The vulnerability manifests when an attacker who already possesses arbitrary memory read and write primitives can exploit the timing gap between when a pointer is authenticated (checked) and when it is actually used, substituting a maliciously crafted pointer in that window to bypass PAC protections. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires local access and high complexity due to the race condition timing requirements, but no user interaction is necessary once the attacker has initial access. Because PAC is a foundational kernel security primitive on modern Apple silicon and A-series devices, its bypass can enable further exploitation chains that would otherwise be blocked by this mitigation.
Frequently Asked Questions
Is CVE-2022-48618 being actively exploited?
Yes. CISA has added CVE-2022-48618 to its Known Exploited Vulnerabilities catalog, and Apple has confirmed reports that this issue was exploited against versions of iOS released before iOS 15.7.1. Organizations should treat this as a confirmed in-the-wild threat, particularly for high-value targets.
What products are affected by CVE-2022-48618?
CVE-2022-48618 affects multiple Apple platforms, specifically: iOS and iPadOS (versions before 16.2), macOS (versions before Ventura 13.1), tvOS (versions before 16.2), and watchOS (versions before 9.2). Devices running iOS prior to 15.7.1 were the primary targets of confirmed exploitation.
How do I fix CVE-2022-48618?
Update all affected Apple devices to the patched releases: macOS Ventura 13.1, iOS 16.2/iPadOS 16.2, tvOS 16.2, and watchOS 9.2 or later. Per CISA guidance, apply vendor mitigations immediately or discontinue use of unpatched products.
How severe is CVE-2022-48618?
CVE-2022-48618 is rated HIGH with a CVSS 3.1 score of 7.0, reflecting high confidentiality, integrity, and availability impact despite the requirement for local access and high attack complexity. With an EPSS percentile of approximately 37.7%, and confirmed in-the-wild exploitation reported by Apple, the real-world risk is significant for targeted attacks on Apple devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.