CVE-2023-28206
Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability
Description
CVE-2023-28206 is an out-of-bounds write vulnerability in Apple's IOSurfaceAccelerator kernel component, affecting iOS, iPadOS, and macOS. This high-severity flaw allows a malicious application to execute arbitrary code with kernel-level privileges, representing a complete compromise of the affected device. CVE-2023-28206 impacts iOS versions prior to 15.7.5 and 16.4.1, iPadOS versions prior to 15.7.5 and 16.4.1, macOS Ventura prior to 13.3.1, macOS Monterey prior to 12.6.5, and macOS Big Sur prior to 11.7.6. Apple has acknowledged that this vulnerability may have been actively exploited in the wild, and CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 1, 2023. The EPSS score of 14.6% (94th percentile) indicates a high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 15.7.5; >= 16.0, < 16.4.1 |
| apple | iphone os | < 15.7.5; >= 16.0, < 16.4.1 |
| apple | macos | < 11.7.6; >= 12.0, < 12.6.5; >= 13.0, < 13.3.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT213720(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213721(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213723(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213724(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT213725(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28206(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
In CVE-2023-28206, Apple's IOSurfaceAccelerator component contains an out-of-bounds write vulnerability where the software writes data past the boundaries of the intended memory buffer. When triggered by a malicious application, this out-of-bounds write in the kernel-level IOSurfaceAccelerator component allows corruption of critical kernel data structures, enabling arbitrary code execution with the highest system privileges.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2023-28206 carries a CVSS v3.1 score of 8.6 (High severity) with an important distinction: the scope is Changed, meaning exploitation can affect resources beyond the vulnerable component itself. Attack Vector (Local): the vulnerability requires a malicious application to be running on the target device, typically achieved through a prior compromise or social engineering to install the app. Attack Complexity (Low): once the malicious application is present, exploitation is reliable and does not require special conditions. Privileges Required (None): the malicious application does not need elevated privileges to trigger the vulnerability; a standard sandboxed application can exploit it. User Interaction (Required): the user must take some action, such as installing or running the malicious application. Scope (Changed): the exploit breaks out of the application sandbox and reaches the kernel, affecting the entire operating system. Confidentiality, Integrity, and Availability (all High): achieving kernel-level code execution grants complete control over the device, including access to all data, the ability to install persistent implants, bypass all security controls, and render the device inoperable. This vulnerability is often chained with CVE-2023-28205, a WebKit vulnerability, to achieve remote kernel exploitation through a single malicious webpage visit.
Exploit Maturity
CVE-2023-28206 has been confirmed as actively exploited in the wild by both Apple and CISA. Apple acknowledged in its security advisories that this IOSurfaceAccelerator vulnerability may have been exploited prior to the patch release. Active Exploitation: CISA added CVE-2023-28206 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 1, 2023. Chaining potential: CVE-2023-28206 is frequently observed in exploit chains paired with CVE-2023-28205, a WebKit use-after-free vulnerability. In this chain, CVE-2023-28205 provides initial remote code execution through malicious web content, and CVE-2023-28206 escalates the attacker's access from the browser sandbox to kernel-level privileges. The EPSS score of 14.6% (94th percentile) indicates a high probability of exploitation activity. The ransomware association is classified as unknown, but kernel-level access makes this vulnerability suitable for deploying persistent spyware and surveillance implants.
Remediation
- Update all affected Apple products immediately. Install the following security updates: iOS 16.4.1 and iPadOS 16.4.1 (HT213720), iOS 15.7.5 and iPadOS 15.7.5 (HT213721), macOS Ventura 13.3.1 (HT213723), macOS Monterey 12.6.5 (HT213724), and macOS Big Sur 11.7.6 (HT213725). CISA requires remediation by May 1, 2023.
- Enable automatic updates on all Apple devices. Configure all managed and personal Apple devices to receive automatic security updates to minimize the window of exposure to zero-day kernel vulnerabilities like CVE-2023-28206.
- Restrict application installation sources. On iOS and iPadOS, ensure that enterprise-signed or sideloaded applications are restricted to authorized sources only. On macOS, enable Gatekeeper and require applications to be from the App Store or identified developers to reduce the risk of malicious application installation.
- Monitor for indicators of compromise. Check for unusual kernel panics, unexpected process activity from IOSurfaceAccelerator, signs of privilege escalation, and unauthorized persistent profiles or configurations that may indicate prior exploitation of CVE-2023-28206.
- Address the full exploit chain. Since CVE-2023-28206 is commonly chained with CVE-2023-28205 (WebKit use-after-free), ensure that both vulnerabilities are patched simultaneously. Deploy web content filtering and DNS-based protections to block access to known exploit delivery domains targeting the WebKit component of the chain.
Technical Details
CVE-2023-28206 is an out-of-bounds write vulnerability (CWE-787) in Apple's IOSurfaceAccelerator, a kernel-level component responsible for managing hardware-accelerated graphics surfaces across iOS, iPadOS, and macOS. Vulnerability Mechanism: the flaw results from insufficient input validation when processing data passed to the IOSurfaceAccelerator kernel extension. A malicious application can supply crafted input that causes the kernel component to write data beyond the boundaries of an allocated buffer, corrupting adjacent kernel memory. This out-of-bounds write can be leveraged to overwrite kernel function pointers or critical data structures, granting the attacker arbitrary code execution at the kernel privilege level. CVSS Vector Analysis (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H): the Changed scope is particularly significant, as it indicates that exploitation within the IOSurfaceAccelerator component crosses a trust boundary from the application sandbox into the kernel. The local attack vector combined with required user interaction means that the attacker needs the victim to run a malicious application, but no special privileges are needed by that application. Apple addressed the vulnerability with improved input validation to prevent the out-of-bounds write condition.
Frequently Asked Questions
Is CVE-2023-28206 being actively exploited?
Yes, CVE-2023-28206 is confirmed to be actively exploited in the wild. Apple acknowledged that this vulnerability may have been exploited prior to the patch release, and CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 1, 2023. It is often used in exploit chains with CVE-2023-28205.
What products are affected by CVE-2023-28206?
CVE-2023-28206 affects Apple iOS (before 15.7.5 and 16.4.1), iPadOS (before 15.7.5 and 16.4.1), macOS Ventura (before 13.3.1), macOS Monterey (before 12.6.5), and macOS Big Sur (before 11.7.6). All devices running these operating system versions are vulnerable.
How do I fix CVE-2023-28206?
To fix CVE-2023-28206, update iOS and iPadOS to version 15.7.5 or 16.4.1, macOS Ventura to 13.3.1, macOS Monterey to 12.6.5, and macOS Big Sur to 11.7.6. Enable automatic updates to receive future security patches promptly. See the Remediation section for a comprehensive patching plan.
How severe is CVE-2023-28206?
CVE-2023-28206 is rated High severity with a CVSS v3.1 score of 8.6 and a Changed scope, meaning exploitation can affect the entire operating system kernel. The EPSS score of 14.6% (94th percentile) confirms a high exploitation probability. Kernel-level code execution represents a complete device compromise, making this a critical vulnerability to patch.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.