CVE-2024-23225
Apple Multiple Products Memory Corruption Vulnerability
Description
CVE-2024-23225 is a high-severity memory corruption vulnerability (out-of-bounds write, CWE-787) affecting the kernel of multiple Apple platforms, including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An attacker who already possesses arbitrary kernel read and write capability can exploit this flaw to bypass kernel memory protections, potentially escaping sandboxes or defeating security mechanisms like Pointer Authentication Codes (PAC). Apple has acknowledged that this issue may have been exploited in the wild, and CISA has listed CVE-2024-23225 in its Known Exploited Vulnerabilities catalog with a remediation deadline of March 27, 2024. The vulnerability was addressed in iOS 16.7.6, iPadOS 16.7.6, iOS 17.4, and iPadOS 17.4.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 16.7.6; >= 17.0, < 17.4 |
| apple | iphone os | < 16.7.6; >= 17.0, < 17.4 |
| apple | macos | >= 12.0, < 12.7.4; >= 13.0, < 13.6.5; >= 14.0, < 14.4 |
| apple | tvos | < 17.4 |
| apple | visionos | < 1.1 |
| apple | watchos | < 10.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/120880(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120881(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120882(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120883(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120884(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120886(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120893(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120895(Release Notes, Vendor Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/18(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/19(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/21(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/22(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/23(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/24(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/25(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/26(Mailing List, Third Party Advisory)
- https://support.apple.com/en-us/HT214081(Vendor Advisory)
- https://support.apple.com/en-us/HT214082(Vendor Advisory)
- https://support.apple.com/kb/HT214082(Vendor Advisory)
- https://support.apple.com/kb/HT214083(Vendor Advisory)
- https://support.apple.com/kb/HT214084(Vendor Advisory)
- https://support.apple.com/kb/HT214085(Vendor Advisory)
- https://support.apple.com/kb/HT214086(Vendor Advisory)
- https://support.apple.com/kb/HT214087(Vendor Advisory)
- https://support.apple.com/kb/HT214088(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23225(US Government Resource)
Weakness Type
CWE-787: Out-of-Bounds Write
CWE-787 describes a weakness where software writes data past the end or before the beginning of an intended buffer. In the context of CVE-2024-23225, the memory corruption in Apple's kernel allows an attacker with existing kernel-level read/write access to write outside the bounds of a buffer, potentially corrupting adjacent kernel memory structures and defeating memory protection mechanisms.
Learn more: CWE-787 — Out-of-Bounds Write
Impact Analysis
CVE-2024-23225 is rated HIGH with a CVSS 3.1 score of 7.8, with the attack vector being local. Confidentiality is fully impacted: an attacker exploiting this vulnerability can read arbitrary kernel memory contents, exposing sensitive system data, cryptographic material, and information from other processes. Integrity is fully impacted: by bypassing kernel memory protections, an attacker can modify kernel data structures, alter the behavior of the operating system, and potentially install persistent kernel-level implants. Availability is also fully impacted, as uncontrolled kernel memory corruption can lead to system crashes or denial of service.
While the local attack vector (requiring an attacker to already have code execution on the device with some level of kernel access) may suggest a more limited threat model, in practice this vulnerability is most dangerous as part of a chained exploit. In mobile threat scenarios, CVE-2024-23225 would typically be used as a second stage after an initial remote code execution or browser sandbox escape exploit, allowing the attacker to fully compromise the device kernel. Apple's acknowledgment that this issue may have been exploited in the wild strongly suggests it was used in exactly such chained attack sequences, potentially in targeted surveillance or spyware campaigns.
Exploit Maturity
CVE-2024-23225 has been confirmed as exploited in the wild by Apple, who stated they were aware of a report that this issue may have been actively exploited. CISA included it in the Known Exploited Vulnerabilities catalog with a March 27, 2024 remediation deadline. Despite this confirmed real-world exploitation, the EPSS score is relatively low at 0.00104 (28th percentile), which reflects the fact that EPSS modeling is based on the characteristics of the vulnerability — the local attack vector and prerequisite for existing kernel access make automated, opportunistic exploitation less likely compared to network-accessible vulnerabilities.
In practice, Apple kernel vulnerabilities of this class are most commonly weaponized by sophisticated threat actors — state-sponsored groups, mercenary spyware vendors (such as those developing tools like Pegasus), or well-resourced criminal organizations — who chain them with remote initial access exploits. CVE-2024-23225 was disclosed and patched alongside CVE-2024-23296, a companion kernel memory corruption issue, and both were addressed in the same iOS 17.4 and iPadOS 17.4 updates, suggesting they may have been exploited together or discovered as part of the same research effort.
Remediation
- Update all affected Apple devices immediately: Apply iOS 16.7.6 or iOS 17.4 (for iPhones), iPadOS 16.7.6 or iPadOS 17.4 (for iPads), and the corresponding updates for macOS, tvOS, visionOS, and watchOS as released by Apple.
- Prioritize devices with sensitive data: Devices used by high-risk individuals (executives, journalists, activists, government personnel) should be updated first given the likely targeted nature of exploitation.
- Enable automatic updates: Configure Apple devices to automatically download and install security updates to reduce the window of exposure for future vulnerabilities.
- Use Lockdown Mode for high-risk users: Apple's Lockdown Mode substantially reduces the attack surface on iOS/iPadOS and is recommended for individuals at elevated risk of sophisticated targeted attacks.
- Follow CISA KEV guidance: Federal agencies and organizations subject to CISA directives must apply the update by the March 27, 2024 deadline per KEV catalog requirements.
- Monitor for signs of compromise: For high-value targets, consider using Apple's threat notification system or mobile security tools to detect indicators of device compromise.
- Review and update MDM policies: Organizations managing Apple devices via MDM should ensure compliance with patching policies and verify that all managed devices have applied the required update.
Technical Details
CVE-2024-23225 is a memory corruption vulnerability classified as CWE-787 (Out-of-Bounds Write) located in the Apple kernel (XNU). An attacker who has already achieved arbitrary kernel read and write capability — typically by exploiting a separate initial-access vulnerability — can exploit this flaw to bypass kernel memory protection mechanisms.
Nature of the flaw: The vulnerability involves improper memory access validation within the kernel, allowing writes outside the intended buffer boundaries. Apple addressed the issue with "improved validation," the standard Apple security bulletin language for input validation and bounds checking fixes in kernel code.
Kernel memory protections targeted: Modern Apple devices implement several kernel memory protection mechanisms, including Pointer Authentication Codes (PAC) on Apple Silicon, Kernel Address Space Layout Randomization (KASLR), and zone-based memory allocators. A successful out-of-bounds write in kernel space can corrupt these structures, allowing an attacker to forge authenticated pointers, defeat KASLR by corrupting kernel metadata, or gain the ability to execute arbitrary code in kernel context.
Attack chain context: CVE-2024-23225 is classified with a local attack vector (AV:L) and requires low privileges (PR:L), meaning exploitation alone does not grant initial device access. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects this: the vulnerability is powerful but requires a foothold. In observed exploitation scenarios, such iOS kernel vulnerabilities are chained with browser or iMessage zero-click exploits. This vulnerability was patched alongside CVE-2024-23296, another kernel memory corruption issue fixed in the same iOS 17.4 release.
Frequently Asked Questions
What devices are affected by CVE-2024-23225?
CVE-2024-23225 affects multiple Apple platforms: iPhones running iOS before 16.7.6 or iOS 17.4, iPads running iPadOS before 16.7.6 or iPadOS 17.4, and devices running macOS, tvOS, visionOS, and watchOS as specified in Apple's security advisories. The fix was included in iOS 16.7.6, iPadOS 16.7.6, iOS 17.4, and iPadOS 17.4, along with corresponding updates for other affected platforms.
Has CVE-2024-23225 been exploited in the wild?
Yes. Apple stated in their security advisory that they are aware of a report that this issue may have been exploited. CISA added CVE-2024-23225 to the Known Exploited Vulnerabilities (KEV) catalog with a March 27, 2024 remediation deadline, confirming its active exploitation status. This type of Apple kernel vulnerability is typically associated with targeted attacks by sophisticated threat actors.
What can an attacker actually do with CVE-2024-23225?
An attacker exploiting CVE-2024-23225 who already has arbitrary kernel read/write capability can bypass kernel memory protections, which in practice means they can defeat key iOS security mechanisms such as Pointer Authentication Codes (PAC), gain stable kernel code execution, and fully compromise the device at the OS level. This enables complete access to all data on the device, installation of persistent implants, and surveillance capabilities.
Is CVE-2024-23225 related to CVE-2024-23296?
Yes, CVE-2024-23225 and CVE-2024-23296 are closely related. Both are Apple kernel memory corruption vulnerabilities (CWE-787) that were discovered and patched at the same time in iOS 17.4 and iPadOS 17.4. Both received CISA KEV designations with the same March 27, 2024 deadline. They may represent companion vulnerabilities discovered in the same kernel subsystem or as part of the same research effort.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.