CVE-2023-42824
Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability
Description
CVE-2023-42824 is a local privilege escalation vulnerability in Apple iOS and iPadOS that allows a local attacker to elevate their privileges on affected devices. The vulnerability, which was fixed in iOS 16.7.1 and iPadOS 16.7.1, stems from insufficient checks in the operating system that could be bypassed to gain elevated access. Apple has acknowledged that this vulnerability may have been actively exploited against versions of iOS before iOS 16.6, and CISA has added CVE-2023-42824 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 26, 2023. With a CVSS v3.1 score of 7.8 (High), this privilege escalation security vulnerability in Apple mobile devices represents a significant threat, particularly in targeted attack scenarios.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 16.7.1; >= 17.0, < 17.0.3 |
| apple | iphone os | < 16.7.1; >= 17.0, < 17.0.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT213972(Vendor Advisory)
- https://support.apple.com/kb/HT213961(Vendor Advisory)
- https://support.apple.com/kb/HT213972(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42824(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2023-42824 by NVD. The vulnerability is described as a privilege escalation issue caused by insufficient checks in the iOS and iPadOS kernel or system components. Based on the nature of the flaw, it likely relates to improper access control or insufficient validation of privilege boundaries within the operating system.
Impact Analysis
CVE-2023-42824 carries a CVSS v3.1 score of 7.8 (High severity) and represents a significant risk for Apple iOS and iPadOS users, particularly those targeted by sophisticated threat actors. Attack Vector (Local): The vulnerability requires local access to the device, meaning the attacker must already have some level of access, such as through a malicious application or a chained exploit delivering initial code execution. Attack Complexity (Low): Once local access is obtained, exploitation requires no special conditions or timing. Privileges Required (Low): The attacker needs only a low-privilege foothold, such as a standard application sandbox, to escalate to higher privileges. User Interaction (None): No user action is required beyond the initial compromise vector. Confidentiality, Integrity, and Availability Impact (all High): Successful privilege escalation grants the attacker access to sensitive data including messages, photos, credentials, and encryption keys, the ability to modify system configurations and install persistent malware, and the capability to disrupt device operations. The EPSS score of 0.99% places this vulnerability in the 76.6th percentile, indicating moderate but noteworthy exploitation probability consistent with its use in targeted attacks rather than widespread campaigns.
Exploit Maturity
Apple has confirmed that CVE-2023-42824 may have been actively exploited against versions of iOS before iOS 16.6, indicating that real-world exploitation occurred prior to the patch release. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 26, 2023, further confirming active exploitation. No public proof-of-concept exploit code has been identified in the available references, which is consistent with Apple iOS vulnerabilities that are typically exploited by sophisticated threat actors using proprietary exploit chains. The EPSS score of 0.99% (76.6th percentile) reflects the targeted nature of the exploitation rather than broad opportunistic attacks.
Remediation
- Update iOS and iPadOS to version 16.7.1 or later immediately. Apple has addressed this vulnerability in iOS 16.7.1 and iPadOS 16.7.1. The KEV required action states: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Ensure all managed iPhones and iPads are updated through your MDM solution or prompt users to update manually.
- Verify device update status across your fleet. Use mobile device management (MDM) tools to audit all enrolled iOS and iPadOS devices and confirm they are running version 16.7.1 or later. Flag and prioritize any devices still running iOS versions prior to 16.6, as these are confirmed to be at highest risk.
- Restrict installation of untrusted applications. Limit sideloading and ensure app installation policies enforce App Store-only sources where possible, reducing the risk of malicious applications gaining the initial local access required for this exploit.
- Monitor for indicators of compromise on mobile devices. Review device logs for signs of unexpected privilege escalation, unusual process behavior, or unauthorized profile installations. Mobile threat defense solutions can help detect exploitation attempts targeting iOS kernel vulnerabilities.
- Implement defense-in-depth for mobile device security. Enforce strong device passcodes, enable automatic updates, maintain current MDM policies, and educate users about the risks of clicking untrusted links or installing unknown apps that could serve as initial compromise vectors for privilege escalation attacks.
Technical Details
CVE-2023-42824 is a privilege escalation vulnerability in Apple iOS and iPadOS caused by insufficient validation checks within the operating system. Attack Vector (Local): The exploit requires the attacker to have local code execution on the device, typically achieved through a malicious application or as part of a multi-stage exploit chain. Attack Complexity (Low): Once local access is established, the privilege escalation can be triggered without requiring specific timing or conditions. Privileges Required (Low): The attacker needs only limited privileges, such as those available within an app sandbox, to exploit the flaw and escalate to higher system privileges. Apple’s description indicates the root cause was addressed by implementing improved checks, suggesting the vulnerability involved a validation bypass that allowed a process to access resources or perform operations beyond its intended privilege level. While no specific CWE has been assigned, the nature of the fix and the impact suggest an issue related to improper access control or insufficient privilege boundary enforcement in the iOS kernel or a privileged system service. The vulnerability was confirmed to have been exploited against iOS versions before iOS 16.6.
Frequently Asked Questions
Is CVE-2023-42824 being actively exploited?
Yes, Apple has acknowledged that CVE-2023-42824 may have been actively exploited against versions of iOS before iOS 16.6. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 26, 2023. The exploitation appears to be targeted rather than widespread, consistent with sophisticated threat actor activity.
What products are affected by CVE-2023-42824?
CVE-2023-42824 affects Apple iOS and iPadOS. The vulnerability was fixed in iOS 16.7.1 and iPadOS 16.7.1. Devices running iOS versions prior to 16.6 are confirmed to be at highest risk of exploitation.
How do I fix CVE-2023-42824?
Update all iPhones and iPads to iOS 16.7.1 or iPadOS 16.7.1 or later. Use your MDM solution to verify update compliance across your device fleet. See the Remediation section above for additional hardening steps.
How severe is CVE-2023-42824?
CVE-2023-42824 is rated High severity with a CVSS v3.1 score of 7.8. While it requires local access (reducing the attack surface compared to network-exploitable vulnerabilities), successful exploitation grants full privilege escalation on the device, compromising confidentiality, integrity, and availability of all device data. The EPSS score of 0.99% (76.6th percentile) reflects targeted exploitation consistent with sophisticated attack campaigns.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.