CVE-2024-23222
Apple Multiple Products WebKit Type Confusion Vulnerability
Description
CVE-2024-23222 is a type confusion vulnerability (CWE-843) in the WebKit browser engine used by Apple iOS, iPadOS, macOS, tvOS, and visionOS. By processing a maliciously crafted web page or web content, an attacker can trigger the type confusion flaw to achieve arbitrary code execution on the victim's device. The vulnerability has been patched in iOS 17.3, iPadOS 17.3, macOS Sonoma 14.3, and tvOS 17.3, and Apple has acknowledged reports that this issue may have been actively exploited in the wild. CISA has added CVE-2024-23222 to its Known Exploited Vulnerabilities catalog, making patching all affected Apple devices an urgent security priority.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | safari | < 17.3 |
| apple | ipados | < 15.8.7; >= 16.0, < 16.7.5; >= 17.0, < 17.3 |
| apple | iphone os | < 15.8.7; >= 16.0, < 16.7.5; >= 17.0, < 17.3 |
| apple | macos | >= 12.0, < 12.7.3; >= 13.0, < 13.6.4; >= 14.0, < 14.3 |
| apple | tvos | < 17.3 |
| apple | visionos | < 1.0.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/118479(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120304(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120305(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120307(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120309(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120310(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120311(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120339(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/126632(Release Notes, Vendor Advisory)
- http://seclists.org/fulldisclosure/2024/Feb/6(Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Jan/34(Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Jan/40(Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/US43EQFC2IS66EA2CPAZFH2RQ6WD7PKF/(Broken Link)
- https://support.apple.com/en-us/HT214055(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT214059(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT214061(Release Notes, Vendor Advisory)
- https://support.apple.com/kb/HT214055(Release Notes, Vendor Advisory)
- https://support.apple.com/kb/HT214056(Release Notes, Vendor Advisory)
- https://support.apple.com/kb/HT214057(Release Notes, Vendor Advisory)
- https://support.apple.com/kb/HT214058(Release Notes, Vendor Advisory)
- https://support.apple.com/kb/HT214059(Release Notes, Vendor Advisory)
- https://support.apple.com/kb/HT214061(Release Notes, Vendor Advisory)
- https://support.apple.com/kb/HT214063(Release Notes, Vendor Advisory)
- https://support.apple.com/kb/HT214070(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23222(US Government Resource)
Weakness Type
CWE-843: Access of Resource Using Incompatible Type (Type Confusion)
CVE-2024-23222 is a type confusion vulnerability in Apple's WebKit engine, where the software accesses or operates on a resource using an incompatible data type. When WebKit processes maliciously crafted web content, the type confusion causes the engine to misinterpret memory regions, potentially allowing an attacker to read from or write to unintended memory locations and ultimately execute arbitrary code on the affected device.
Learn more: CWE-843 — Access of Resource Using Incompatible Type (Type Confusion)
Impact Analysis
CVE-2024-23222 carries a CVSS 3.1 score of 8.8 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Attack Vector (Network): the vulnerability is remotely exploitable through malicious web content, requiring no physical access to the target device. Attack Complexity (Low): exploitation requires no special conditions beyond getting a victim to process attacker-controlled web content. Privileges Required (None): the attacker needs no prior authentication or access. User Interaction (Required): the victim must visit a malicious website or open a malicious file — a typical attack scenario for browser engine vulnerabilities. Confidentiality (High), Integrity (High), and Availability (High): successful exploitation could allow the attacker to execute arbitrary code on the device, gaining full access to device data, the ability to install malware, and disruption of device operation. CISA's confirmation of in-the-wild exploitation makes this vulnerability an active threat requiring immediate action.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2024-23222 and has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 13, 2024. Apple has acknowledged reports that this issue may have been exploited in the wild, consistent with the targeting of Apple platform vulnerabilities by sophisticated threat actors. No references tagged as public exploit code or PoC are available in the provided references, and the EPSS score of approximately 0.22% (43.9th percentile) suggests broad automated exploitation is not yet widespread. However, the confirmed in-the-wild use — combined with the WebKit attack surface reachable by simply visiting a web page — means any unpatched Apple device is at meaningful risk from targeted attacks.
Remediation
- Apply vendor-supplied patches immediately: Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Update affected Apple devices to patched releases: Install iOS 17.3 or iPadOS 17.3 for iPhone and iPad, macOS Sonoma 14.3 for Mac, and tvOS 17.3 for Apple TV. visionOS users should also apply available updates as referenced in Apple's security notes.
- Enable automatic updates on all Apple devices: Configure iOS, iPadOS, macOS, tvOS, and visionOS devices to install security updates automatically to minimize the window of exposure for future WebKit vulnerabilities.
- Exercise caution with untrusted web content: While patching proceeds, avoid visiting untrusted websites or opening untrusted links, particularly on unpatched devices — the vulnerability requires user interaction with malicious web content to trigger.
- Review device access and browser activity logs: On enterprise-managed Apple devices, audit recent browser activity and look for signs of unexpected code execution or unusual network connections that could indicate prior exploitation.
Technical Details
CVE-2024-23222 is a type confusion vulnerability (CWE-843) in Apple's WebKit browser engine, the rendering engine used by Safari and embedded web views across iOS, iPadOS, macOS, tvOS, and visionOS. Type confusion vulnerabilities arise when the software incorrectly handles objects of different types interchangeably, causing memory to be accessed and interpreted in a manner inconsistent with its actual structure. In this case, processing specially crafted web content causes WebKit to mishandle type information for an internal object, creating conditions for memory corruption that can be leveraged to achieve arbitrary code execution within the WebKit rendering process. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a scenario where simply visiting a malicious webpage — requiring only user interaction — is sufficient to trigger the flaw remotely without any additional privileges. Apple addressed the vulnerability through improved type validation checks in the patched OS releases.
Frequently Asked Questions
Is CVE-2024-23222 being actively exploited?
Yes. CISA has confirmed active exploitation and added CVE-2024-23222 to its Known Exploited Vulnerabilities catalog with a remediation deadline of February 13, 2024. Apple has acknowledged reports that this issue may have been exploited in the wild, consistent with targeted attacks on Apple devices.
What products are affected by CVE-2024-23222?
CVE-2024-23222 affects Apple iOS, iPadOS, macOS, tvOS, and visionOS. The vulnerability is patched in iOS 17.3, iPadOS 17.3, macOS Sonoma 14.3, and tvOS 17.3. All devices running earlier versions of these operating systems that include WebKit are potentially at risk.
How do I fix CVE-2024-23222?
Update your Apple devices to the patched OS versions: iOS/iPadOS 17.3, macOS Sonoma 14.3, or tvOS 17.3. Per CISA guidance, apply vendor mitigations immediately or discontinue use of unpatched products. Enabling automatic updates will help ensure timely protection.
How severe is CVE-2024-23222?
CVE-2024-23222 is rated HIGH with a CVSS 3.1 score of 8.8, reflecting remote exploitability via malicious web content with high impact on confidentiality, integrity, and availability. CISA has confirmed in-the-wild exploitation, making this an urgent remediation priority despite its lower EPSS score of 0.22%.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.