Improper authentication in Apple iOS and iPadOS - CVE-2022-48618
Published: January 15, 2024
Vulnerability identifier: #VU85363
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-48618
CWE-ID: CWE-287
Exploitation vector: Local access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a local application to compromise the affected system.
The vulnerability exists due to an error within the OS kernel. A local application or user with arbitrary read and write capability can bypass Pointer Authentication and compromise the affected system.
Note, the vulnerability is being actively exploited in the wild against versions of iOS released before iOS 15.7.1.
Affected software
Apple iOS
iPadOS
tvOS
watchOS
macOS
iPadOS
tvOS
watchOS
macOS
How to mitigate CVE-2022-48618
Install updates from vendor's website.
Apple iOS - addressed in versions 15.7.1 19H117, 16.2 20C65
iPadOS - addressed in versions 15.7.1 19H117, 16.2 20C65
tvOS - update to 16.2 20K362
watchOS - update to 9.2 20S361
macOS - update to 13.1 22C65
iPadOS - addressed in versions 15.7.1 19H117, 16.2 20C65
tvOS - update to 16.2 20K362
watchOS - update to 9.2 20S361
macOS - update to 13.1 22C65