CVE-2023-28204
Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability
Description
CVE-2023-28204 is a medium-severity out-of-bounds read vulnerability in Apple WebKit that affects Safari, iOS, iPadOS, macOS Ventura, tvOS, watchOS, and WebKitGTK+. The flaw results from insufficient input validation when processing web content, allowing an attacker to trigger an out-of-bounds memory read that can disclose sensitive information. Apple has acknowledged that CVE-2023-28204 may have been actively exploited before patches were released in May 2023. CISA has listed this WebKit vulnerability in its Known Exploited Vulnerabilities catalog with a remediation deadline of June 12, 2023.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | safari | < 16.5 |
| apple | ipados | < 15.7.6; >= 16.0, < 16.5 |
| apple | iphone os | < 15.7.6; >= 16.0, < 16.5 |
| apple | macos | >= 13.0, < 13.4 |
| apple | tvos | < 16.5 |
| apple | watchos | < 9.5 |
| webkitgtk | webkitgtk\+ | < 2.42.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- https://security.gentoo.org/glsa/202401-04(Third Party Advisory)
- https://support.apple.com/en-us/HT213757(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213758(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213761(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213762(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213764(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213765(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28204(US Government Resource)
Weakness Type
CWE-125: Out-of-bounds Read
In the context of CVE-2023-28204, Apple WebKit fails to properly validate input during web content processing, allowing a read operation to access memory beyond the intended buffer boundaries. This out-of-bounds read weakness can expose sensitive data from the process's memory space, potentially leaking information useful for further exploitation such as memory layout details or authentication tokens.
Learn more: CWE-125 — Out-of-bounds Read
Impact Analysis
CVE-2023-28204 carries a CVSS v3.1 score of 6.5 (Medium), reflecting a targeted information disclosure risk in Apple's WebKit engine. The vulnerability is remotely exploitable without physical access via malicious web content, with low attack complexity and no authentication required. However, user interaction is required — a victim must visit a malicious webpage or process crafted web content for the exploit to trigger. The confidentiality impact is High, meaning an attacker can read sensitive data from the WebKit process memory, while integrity and availability are not affected. Although the EPSS score of 0.048% suggests relatively low widespread exploitation probability, the vulnerability is particularly valuable as an information leak primitive in exploit chains — it can reveal memory layout information (such as ASLR base addresses) that enables more powerful attacks like code execution when combined with vulnerabilities such as CVE-2023-32373. CISA's inclusion in the KEV catalog confirms real-world exploitation has occurred.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-28204 by adding it to the Known Exploited Vulnerabilities catalog, with a remediation deadline of June 12, 2023. Apple's advisory explicitly states that this issue may have been actively exploited before patching. The EPSS score of 0.048% indicates that exploitation is highly targeted rather than widespread, consistent with its use by sophisticated threat actors in zero-day exploit chains. CVE-2023-28204 is commonly referenced alongside CVE-2023-32373 (a WebKit use-after-free) and CVE-2023-32409 (a WebKit sandbox escape), as these three vulnerabilities were patched in the same Apple security updates and likely formed components of a complete attack chain from initial information disclosure through code execution to sandbox escape.
Remediation
- Update all affected Apple and WebKitGTK+ platforms immediately as directed by CISA's KEV required action. Apply the following updates: iOS 16.5/iPadOS 16.5 or later, iOS 15.7.6/iPadOS 15.7.6 or later for older devices, macOS Ventura 13.4 or later, Safari 16.5 or later, tvOS 16.5 or later, watchOS 9.5 or later, and WebKitGTK+ to the latest patched version.
- Deploy patches through MDM solutions to ensure all managed Apple devices in your organization receive the security updates promptly. Prioritize devices used for browsing or that process untrusted web content.
- Implement web content filtering on unpatched devices to restrict access to potentially malicious websites. Use proxy solutions or DNS-based filtering to reduce exposure to crafted web content that could trigger the out-of-bounds read.
- Monitor for indicators of compromise by reviewing browser crash reports and device logs for unusual WebKit process behavior. Look for signs of information leakage or memory corruption that may indicate exploitation attempts.
- Strengthen input validation practices as a long-term defense measure by ensuring all web content processing components enforce strict bounds checking. Keep all WebKit-based applications and their underlying frameworks updated to mitigate future out-of-bounds read vulnerabilities.
Technical Details
CVE-2023-28204 exploits an out-of-bounds read weakness (CWE-125) in Apple WebKit's web content processing pipeline. The vulnerability arises when WebKit processes specially crafted web content that triggers a read operation beyond the boundaries of an allocated memory buffer due to insufficient input validation. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) shows that while the attack is network-accessible and requires low complexity, user interaction is necessary — the victim must navigate to a page serving the malicious content. The High confidentiality impact with no integrity or availability impact confirms this is an information disclosure primitive: the attacker can read sensitive process memory but cannot directly modify data or cause crashes. This type of out-of-bounds read is commonly used as the first stage in a multi-step exploit chain, leaking memory addresses to defeat Address Space Layout Randomization (ASLR) before leveraging a separate code execution vulnerability. The fix involved improved input validation to enforce proper bounds checking during web content processing.
Frequently Asked Questions
Is CVE-2023-28204 being actively exploited?
Yes, CVE-2023-28204 has been actively exploited. Apple confirmed that this issue may have been exploited prior to patch availability, and CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 12, 2023. Exploitation appears to be targeted, likely as part of sophisticated attack chains.
What products are affected by CVE-2023-28204?
CVE-2023-28204 affects Apple Safari (before 16.5), iOS (before 16.5 and 15.7.6), iPadOS (before 16.5 and 15.7.6), macOS Ventura (before 13.4), tvOS (before 16.5), watchOS (before 9.5), and WebKitGTK+. All platforms using the WebKit rendering engine are potentially vulnerable.
How do I fix CVE-2023-28204?
Update all affected devices to the latest available versions: iOS/iPadOS 16.5+ or 15.7.6+, macOS Ventura 13.4+, Safari 16.5+, tvOS 16.5+, watchOS 9.5+, and WebKitGTK+ to the latest release. Use MDM to deploy patches across managed devices and restrict web browsing on unpatched systems.
How severe is CVE-2023-28204?
CVE-2023-28204 is rated Medium with a CVSS v3.1 score of 6.5 out of 10. While it is an information disclosure vulnerability requiring user interaction, it is particularly dangerous when used as part of an exploit chain alongside code execution and sandbox escape vulnerabilities, enabling full device compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.