CVE-2023-28205
Apple Multiple Products WebKit Use-After-Free Vulnerability
Description
CVE-2023-28205 is a use-after-free vulnerability in Apple WebKit, the browser engine used by Safari, iOS, iPadOS, and macOS. This high-severity flaw allows remote attackers to achieve arbitrary code execution by luring a victim into processing maliciously crafted web content. CVE-2023-28205 affects Safari versions prior to 16.4.1, iOS 15.7.5 and 16.4.1, iPadOS 15.7.5 and 16.4.1, and macOS Ventura 13.3.1. Apple has acknowledged that this vulnerability may have been actively exploited in the wild prior to the patch release, and CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 1, 2023. While the EPSS score of 0.07% is relatively low, the confirmed active exploitation and broad impact across the Apple ecosystem make immediate patching critical.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | safari | < 16.4.1 |
| apple | ipados | < 15.7.5; >= 16.0, < 16.4.1 |
| apple | iphone os | < 15.7.5; >= 16.0, < 16.4.1 |
| apple | macos | < 13.3.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT213720(Release Notes)
- https://support.apple.com/en-us/HT213721(Release Notes)
- https://support.apple.com/en-us/HT213722(Release Notes)
- https://support.apple.com/en-us/HT213723(Release Notes)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28205(US Government Resource)
Weakness Type
CWE-416: Use After Free
In CVE-2023-28205, Apple WebKit contains a use-after-free vulnerability where the application references memory after it has been freed. When processing maliciously crafted web content, WebKit accesses a previously deallocated memory object, which an attacker can exploit to corrupt memory and achieve arbitrary code execution within the browser or application context.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2023-28205 carries a CVSS v3.1 score of 8.8 (High severity), reflecting the significant risk posed by this WebKit vulnerability across the Apple product ecosystem. Attack Vector (Network): the vulnerability is remotely exploitable over the internet, as it is triggered by processing malicious web content delivered through a browser or any application that renders web content using WebKit. Attack Complexity (Low): exploitation does not require special conditions beyond delivering crafted web content to the victim. Privileges Required (None): the attacker does not need any authentication or account on the target system. User Interaction (Required): the victim must visit a malicious webpage or click a link containing the exploit payload, making this a typical drive-by download scenario. Confidentiality, Integrity, and Availability (all High): successful exploitation grants the attacker arbitrary code execution within the application's context, potentially allowing theft of sensitive data, installation of spyware, modification of application behavior, and disruption of device functionality. The broad scope of affected products including Safari, iOS, iPadOS, and macOS means that billions of Apple devices were potentially vulnerable before the patch was released.
Exploit Maturity
CVE-2023-28205 has been confirmed as actively exploited in the wild. Apple acknowledged in its security advisories that this WebKit use-after-free vulnerability may have been exploited prior to the patch release. Active Exploitation: CISA added CVE-2023-28205 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 1, 2023, underscoring the urgency of patching. The EPSS score of 0.07% (21st percentile) is notably low relative to the confirmed exploitation, which may reflect the targeted nature of the attacks rather than widespread indiscriminate exploitation. No publicly tagged exploit code was identified in the available references, suggesting that exploitation may be limited to sophisticated threat actors using private exploit toolkits. The ransomware association is classified as unknown.
Remediation
- Update all affected Apple products immediately. Install the following security updates: Safari 16.4.1 (HT213722), iOS 16.4.1 and iPadOS 16.4.1 (HT213720), iOS 15.7.5 and iPadOS 15.7.5 (HT213721), and macOS Ventura 13.3.1 (HT213723). CISA requires remediation by May 1, 2023.
- Enable automatic updates on all Apple devices. Ensure that automatic software updates are enabled on all iOS, iPadOS, and macOS devices to receive critical security patches as soon as they are released, reducing the window of exposure to zero-day vulnerabilities.
- Implement web content filtering as an interim mitigation. Deploy network-level web content filtering or DNS-based security solutions to block access to known malicious domains that may be serving exploit payloads targeting WebKit vulnerabilities.
- Monitor for indicators of compromise. Review device logs for unusual WebKit crashes, unexpected process spawning from Safari or WebKit-based applications, and signs of unauthorized data exfiltration that may indicate prior exploitation.
- Educate users about phishing and malicious links. Since exploitation requires user interaction (visiting a malicious webpage), train users to recognize and avoid suspicious links, especially in targeted spear-phishing scenarios that may deliver WebKit exploits.
Technical Details
CVE-2023-28205 is a use-after-free vulnerability (CWE-416) in Apple WebKit, the rendering engine underlying Safari and all WebKit-based applications on iOS, iPadOS, and macOS. Vulnerability Mechanism: the flaw occurs when WebKit processes specially crafted web content that triggers a sequence of operations causing a memory object to be freed prematurely while still being referenced by another part of the rendering engine. When the freed memory is subsequently reallocated and overwritten, the dangling reference allows an attacker to control the contents of the memory region, enabling arbitrary code execution. CVSS Vector Analysis (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): the network attack vector confirms that exploitation occurs remotely through web content delivery, and the required user interaction reflects the need for the victim to navigate to or be redirected to the malicious content. Despite the user interaction requirement, the low attack complexity and no privileges required make this vulnerability highly exploitable in targeted attack scenarios. Apple addressed the vulnerability with improved memory management, ensuring that object lifetimes are correctly tracked to prevent use-after-free conditions during web content processing.
Frequently Asked Questions
Is CVE-2023-28205 being actively exploited?
Yes, CVE-2023-28205 has been actively exploited in the wild. Apple confirmed that the vulnerability may have been exploited prior to the patch release, and CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 1, 2023. The ransomware usage status is currently unknown.
What products are affected by CVE-2023-28205?
CVE-2023-28205 affects multiple Apple products including Safari (versions before 16.4.1), iOS and iPadOS (versions before 15.7.5 and 16.4.1), and macOS Ventura (versions before 13.3.1). Any device running these software versions with WebKit-based applications is potentially vulnerable.
How do I fix CVE-2023-28205?
To fix CVE-2023-28205, update Safari to version 16.4.1, iOS and iPadOS to version 15.7.5 or 16.4.1, and macOS Ventura to version 13.3.1. These updates are available through the standard Apple software update mechanisms. See the Remediation section for additional protective measures.
How severe is CVE-2023-28205?
CVE-2023-28205 is rated High severity with a CVSS v3.1 score of 8.8. It enables remote arbitrary code execution through malicious web content, requiring only that a user visits or is redirected to a malicious webpage. The confirmed active exploitation makes this a critical vulnerability to address despite the relatively low EPSS score of 0.07%.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.