CVE-2024-23296
Apple Multiple Products Memory Corruption Vulnerability
Description
CVE-2024-23296 is a high-severity memory corruption vulnerability (out-of-bounds write, CWE-787) in the Apple kernel affecting iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An attacker who already possesses arbitrary kernel read and write capability can exploit this flaw to bypass kernel memory protections, potentially enabling full device compromise. Apple has confirmed awareness of reports that CVE-2024-23296 may have been exploited in the wild, and CISA has included it in the Known Exploited Vulnerabilities catalog with a March 27, 2024 remediation deadline. The vulnerability was addressed in iOS 17.4 and iPadOS 17.4, among other platform updates.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 16.7.8; >= 17.0, < 17.4 |
| apple | iphone os | < 16.7.8; >= 17.0, < 17.4 |
| apple | macos | >= 12.0, < 12.7.6; >= 13.0, < 13.6.7; >= 14.0, < 14.4 |
| apple | tvos | < 17.4 |
| apple | visionos | < 1.1 |
| apple | watchos | < 10.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/120881(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120882(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120883(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120893(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120895(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120898(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120900(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/120910(Release Notes, Vendor Advisory)
- http://seclists.org/fulldisclosure/2024/Jul/20(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/18(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/21(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/24(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/25(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/Mar/26(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/May/11(Mailing List, Third Party Advisory)
- http://seclists.org/fulldisclosure/2024/May/13(Mailing List, Third Party Advisory)
- https://support.apple.com/en-us/HT214081(Vendor Advisory)
- https://support.apple.com/kb/HT214081(Vendor Advisory)
- https://support.apple.com/kb/HT214084(Vendor Advisory)
- https://support.apple.com/kb/HT214086(Vendor Advisory)
- https://support.apple.com/kb/HT214087(Vendor Advisory)
- https://support.apple.com/kb/HT214088(Vendor Advisory)
- https://support.apple.com/kb/HT214100(Vendor Advisory)
- https://support.apple.com/kb/HT214107(Vendor Advisory)
- https://support.apple.com/kb/HT214118(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23296(US Government Resource)
Weakness Type
CWE-787: Out-of-Bounds Write
CWE-787 occurs when software writes data beyond the bounds of an allocated buffer, potentially corrupting adjacent memory. In CVE-2024-23296, this out-of-bounds write flaw exists within the Apple kernel and can be leveraged by an attacker with existing kernel-level access to corrupt memory protection structures, enabling bypass of kernel security mechanisms.
Learn more: CWE-787 — Out-of-Bounds Write
Impact Analysis
CVE-2024-23296 carries a CVSS 3.1 score of 7.8 (HIGH), with the local attack vector reflecting that exploitation requires an attacker who already has some level of kernel access. Confidentiality is fully impacted: exploiting this vulnerability allows the attacker to read arbitrary kernel memory, exposing cryptographic keys, user credentials, and data from other processes or apps on the device. Integrity is fully impacted: bypassing kernel memory protections allows the attacker to modify kernel data structures, alter system behavior, and potentially install persistent kernel-level malicious code that survives device reboots. Availability is fully impacted, since uncontrolled kernel memory corruption can also trigger system instability or crashes.
In real-world attack scenarios, CVE-2024-23296 would serve as the privilege escalation or kernel protection bypass stage in a multi-stage attack chain. An adversary would first use a separate vulnerability to achieve initial code execution — for instance, via a compromised app, a browser exploit, or an iMessage zero-click attack — and then apply CVE-2024-23296 to defeat kernel-level defenses such as Pointer Authentication Codes (PAC) and Kernel Address Space Layout Randomization (KASLR). The result is full kernel code execution and complete device control. Apple's confirmed knowledge of real-world exploitation strongly suggests this chained attack model was actively employed.
Exploit Maturity
CVE-2024-23296 has been confirmed as exploited in the wild, with Apple noting awareness of a report of active exploitation. CISA listed it in the KEV catalog with a March 27, 2024 remediation deadline. The EPSS score of 0.00112 (approximately 30th percentile) is low relative to the confirmed exploitation, which is characteristic of kernel-level vulnerabilities with local attack vectors — they are less susceptible to automated scanning and mass exploitation but are highly attractive to sophisticated targeted attackers.
CVE-2024-23296 was patched simultaneously with CVE-2024-23225, another Apple kernel memory corruption flaw, both addressed in iOS 17.4. This pairing, combined with Apple's simultaneous disclosure and the CISA KEV designations for both, strongly suggests these vulnerabilities were discovered together or used as part of a coordinated exploit chain. Exploitation of this class of Apple kernel vulnerability is primarily observed in sophisticated targeted attack campaigns, typically attributed to state-sponsored actors or commercial spyware vendors operating surveillance tools against journalists, activists, and government personnel.
Remediation
- Apply Apple security updates immediately: Update to iOS 17.4, iPadOS 17.4, and the corresponding updates for macOS, tvOS, visionOS, and watchOS as provided by Apple. These updates contain the official patch for CVE-2024-23296.
- Also apply iOS 16.7.6 for older devices: For devices not eligible for iOS 17, apply iOS 16.7.6 or iPadOS 16.7.6 as appropriate.
- Enable automatic updates: Configure devices to automatically install security updates to minimize future exposure windows.
- Prioritize high-risk individuals: Users in high-risk categories (political targets, journalists, executives, government officials) should update immediately and consider enabling Apple Lockdown Mode.
- Use Apple Lockdown Mode: For individuals at elevated risk of sophisticated targeted attacks, Lockdown Mode significantly reduces the iOS attack surface.
- Comply with CISA KEV requirements: Federal agencies and CISA-directive-subject organizations must apply mitigations by the March 27, 2024 deadline.
- Review MDM device compliance: Organizations with Mobile Device Management (MDM) solutions should verify all managed Apple devices are compliant with the required patch level.
- Investigate potential prior compromise: High-value targets who may have been exposed to this vulnerability should consider professional mobile forensic analysis to detect signs of compromise before patching.
Technical Details
CVE-2024-23296 is an out-of-bounds write memory corruption vulnerability (CWE-787) located in the Apple kernel (XNU), addressed with "improved validation" in iOS 17.4 and iPadOS 17.4. The vulnerability allows an attacker with arbitrary kernel read and write capability to write outside intended buffer boundaries, corrupting adjacent kernel memory and bypassing kernel protection mechanisms.
Technical context: Apple's XNU kernel on modern devices implements several defensive memory protection technologies: Pointer Authentication Codes (PAC) using hardware authentication of code and data pointers, Kernel Address Space Layout Randomization (KASLR) to randomize kernel memory layout, and memory zone allocators that isolate kernel object types. An out-of-bounds write in kernel space can corrupt pointer values or zone metadata, defeating these mitigations and enabling stable kernel code execution.
Attack prerequisites and vector: The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a local attack with low complexity, requiring low privileges and no user interaction. This means the vulnerability cannot be exploited remotely on its own — an attacker must first achieve local code execution on the device, typically through a chained exploit.
Relationship to CVE-2024-23225: CVE-2024-23296 was disclosed and patched simultaneously with CVE-2024-23225, another kernel out-of-bounds write vulnerability fixed in the same iOS 17.4 release. Both vulnerabilities received CISA KEV designations with identical deadlines, suggesting discovery in the same research context and possibly deployment in the same exploit chain. The simultaneous patch and disclosure is consistent with Apple's approach to coordinated vulnerability disclosure for actively exploited kernel flaws.
Frequently Asked Questions
What is the difference between CVE-2024-23296 and CVE-2024-23225?
Both CVE-2024-23296 and CVE-2024-23225 are Apple kernel out-of-bounds write (CWE-787) vulnerabilities patched in iOS 17.4 and iPadOS 17.4, and both received CISA KEV designations with March 27, 2024 deadlines. CVE-2024-23225 was additionally patched in iOS 16.7.6 for older devices, while CVE-2024-23296 appears in the iOS 17.4 patch specifically. Both likely represent related flaws discovered together and possibly used in tandem in exploit chains.
Is CVE-2024-23296 exploited in the wild?
Yes. Apple stated in their security advisory that they are aware of a report that CVE-2024-23296 may have been actively exploited. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog with a March 27, 2024 remediation deadline. This confirmed exploitation, combined with the local attack vector, is consistent with targeted attack campaigns using multi-stage exploit chains to achieve full device compromise.
What Apple devices and software versions are affected?
CVE-2024-23296 affects Apple iOS and iPadOS before version 17.4, along with corresponding versions of macOS, tvOS, visionOS, and watchOS. Apple released patches in iOS 17.4 and iPadOS 17.4 (and updates for other affected platforms). Devices that cannot run iOS 17 should consult Apple's advisory for guidance on available backported fixes.
Why is the EPSS score low if this CVE is confirmed exploited?
The EPSS (Exploit Prediction Scoring System) score of 0.00112 reflects the statistical probability of exploitation based on vulnerability characteristics — factors like the local attack vector and prerequisite kernel access requirement lower the predicted exploitation rate. EPSS models general exploitation risk, not targeted attacks. CVE-2024-23296 is exploited by sophisticated actors in targeted campaigns, not through mass automated scanning, which explains the disconnect between the low EPSS score and confirmed active exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.