CVE-2023-38606

CVE-2023-38606 carries a CVSS 3.1 base score of 5.5 (Medium severity), though the real-world impact is amplified by its confirmed use in targeted exploitation campaigns. Attack Vector (Local): The vulnerability requires the attacker to have local access, typically achieved by convincing a user to install a malicious application or through a chained exploit delivering the payload. Attack Complexity (Low): Once the malicious app is on the device, exploitation is straightforward with no special conditions needed. Privileges Required (None): No elevated privileges are required to trigger the vulnerability, meaning any installed application could potentially exploit it. User Interaction (Required): The victim must take an action such as installing or opening the malicious application. Integrity Impact (High): The ability to modify sensitive kernel state is a severe integrity violation, as it can undermine the fundamental security guarantees of the operating system, including code signing enforcement, sandboxing, and privilege boundaries. Confidentiality and Availability (None): The CVSS scoring indicates no direct impact on confidentiality or availability from this specific vulnerability alone, though when used as part of a larger exploit chain, the kernel state modification can enable further attacks with broader impact. The relatively low EPSS score of 0.097% reflects the targeted nature of the exploitation rather than broad opportunistic attacks.