CVE-2023-42917
Apple Multiple Products WebKit Memory Corruption Vulnerability
Description
CVE-2023-42917 is a memory corruption vulnerability in Apple's WebKit browser engine, rated HIGH with a CVSS score of 8.8. The flaw was addressed with improved locking mechanisms and affects iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, and Safari 17.1.2 — all versions prior to these releases are vulnerable. Processing maliciously crafted web content can trigger memory corruption and lead to arbitrary code execution on the victim's device. Apple confirmed that this vulnerability was actively exploited in the wild against versions of iOS before iOS 16.7.1, making timely patching essential.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | safari | < 17.1.2 |
| apple | ipados | < 15.8.1; >= 16.0, < 16.7.3; >= 17.0, < 17.1.2 |
| apple | iphone os | < 15.8.1; >= 16.0, < 16.7.3; >= 17.0, < 17.1.2 |
| apple | macos | >= 14.0, < 14.1.2 |
| debian | debian linux | 11.0; 12.0 |
| fedoraproject | fedora | 38; 39 |
| webkitgtk | webkitgtk\+ | < 2.42.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://seclists.org/fulldisclosure/2023/Dec/12(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2023/Dec/13(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2023/Dec/3(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2023/Dec/4(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2023/Dec/5(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2023/Dec/8(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Jan/35(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/12/05/1(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/(Mailing List)
- https://security.gentoo.org/glsa/202401-04(Third Party Advisory)
- https://support.apple.com/en-us/HT214031(Vendor Advisory)
- https://support.apple.com/en-us/HT214032(Vendor Advisory)
- https://support.apple.com/en-us/HT214033(Vendor Advisory)
- https://support.apple.com/kb/HT214033(Vendor Advisory)
- https://support.apple.com/kb/HT214034(Vendor Advisory)
- https://support.apple.com/kb/HT214062(Vendor Advisory)
- https://www.debian.org/security/2023/dsa-5575(Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-42917(US Government Resource)
Weakness Type
CWE-787: Out-of-Bounds Write
This vulnerability is classified under CWE-787: Out-of-Bounds Write, a memory safety weakness where a program writes data beyond the boundaries of an allocated memory buffer. In the context of CVE-2023-42917, the WebKit engine's locking logic contained a flaw that allowed memory corruption to occur during web content processing. Out-of-bounds write vulnerabilities in browser engines are particularly severe because they can be triggered remotely through crafted web pages and often lead directly to arbitrary code execution in the context of the browser or underlying operating system process.
Impact Analysis
The vulnerability carries a HIGH severity rating with a CVSS score of 8.8, reflecting its full confidentiality, integrity, and availability impact. An attacker who successfully exploits this flaw can achieve arbitrary code execution on the victim's device, potentially gaining complete control over the system. The attack vector is network-based with low complexity — a user need only visit a malicious or compromised website for the exploit to trigger, making drive-by attacks a realistic threat scenario. Although user interaction (visiting a page) is required, no privileges are needed on the attacker's side. The scope remains unchanged (U), meaning the exploit is contained within the WebKit process, but arbitrary code execution within a browser engine still represents a critical breach of device security. Apple's acknowledgment of active exploitation against pre-iOS 16.7.1 devices confirms that this vulnerability was weaponized in real-world attacks.
Exploit Maturity
Apple explicitly acknowledged that this vulnerability may have been exploited against iOS versions prior to 16.7.1, placing it firmly in the category of actively exploited zero-days at the time of disclosure. The EPSS score of 0.00068 (20th percentile) reflects a low probability of broader exploitation post-patch, which is consistent with the targeted nature of WebKit zero-days — typically used in sophisticated, targeted attacks rather than widespread opportunistic exploitation. The KEV catalog inclusion with a due date of 2023-12-25 underscores the confirmed exploitation status. Organizations relying on Apple devices for sensitive operations should treat this as a priority-level risk.
Remediation
- Update immediately: Install iOS 17.1.2 / iPadOS 17.1.2, macOS Sonoma 14.1.2, or Safari 17.1.2. These releases contain the fix for CVE-2023-42917.
- Check legacy devices: Devices that cannot be updated to iOS 17 should be evaluated for continued use; consider migrating to supported hardware.
- Apply per vendor instructions: Follow Apple's security advisories at https://support.apple.com for guidance specific to your platform.
- Monitor for indicators of compromise: Given the confirmed in-the-wild exploitation, review device logs and consider endpoint detection tools if sensitive data was potentially exposed.
- Enforce mobile device management (MDM) policies: Use MDM to enforce minimum OS versions across your device fleet and prevent operation of unpatched devices.
- Update WebKitGTK on Linux: If running WebKitGTK-based browsers on Debian or Fedora, apply the corresponding distribution patches (DSA-5575 for Debian).
Technical Details
CVE-2023-42917 stems from a memory corruption flaw in the WebKit rendering engine caused by a locking deficiency. WebKit, the browser engine underlying Safari, iOS WebView, and macOS system browsers, processes untrusted web content in a sandboxed environment. The vulnerability manifests when WebKit processes crafted web content that triggers a code path with improper locking, leading to a race condition or incorrect memory access that corrupts heap or stack memory (CWE-787). Apple's fix improved locking to ensure proper synchronization during web content processing. The CVSSv3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects that the attack is network-delivered, low complexity, requires no attacker privileges, but does require a user to render the malicious content. Affected platforms include all Apple devices running iOS, iPadOS, and macOS prior to the patched releases, as well as WebKitGTK on Linux-based distributions. The vulnerability was patched alongside CVE-2023-42916, another WebKit flaw disclosed simultaneously.
Frequently Asked Questions
Who is affected by CVE-2023-42917?
Anyone running Apple Safari, iOS, iPadOS, or macOS prior to the December 2023 patched releases (iOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2) is potentially affected. Linux users running WebKitGTK-based browsers on Debian or Fedora are also at risk without the respective distribution patches applied.
Was CVE-2023-42917 exploited in the wild?
Yes. Apple confirmed that the vulnerability was actively exploited against iOS versions prior to iOS 16.7.1. The CISA KEV catalog lists this vulnerability with a remediation deadline of December 25, 2023, confirming its exploitation status.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by luring a victim to visit a specially crafted website. When the WebKit engine processes the malicious web content, the memory corruption flaw is triggered, potentially enabling arbitrary code execution. No attacker privileges are required — only the victim's browser interaction.
Is disabling JavaScript sufficient to mitigate this vulnerability?
Apple's fix was applied to the WebKit engine itself through improved locking logic, not JavaScript parsing. While restricting JavaScript execution may reduce the attack surface, it is not a guaranteed mitigation. The only reliable remediation is to update to the patched OS and browser versions specified in Apple's security advisories.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.