Joseph Ravichandran

A use after free issue existed due to improper memory management. This could allow an application to cause unexpected system termination.

The issue was addressed with improved memory handling. Connecting to a malicious AFP server may corrupt kernel memory.

The issue is a race condition within the `kauth cred proc update()` function of the macOS and iPadOS kernel. This race condition, stemming from improper synchronization when sharing a resource, can lead to out-of-bounds writes in memory. Successful exploitation may allow a remote attacker to cause a denial of service or potentially gain unauthorized access. The issue was addressed through improved memory handling. Reports indicate the potential for applications to cause unexpected system termination or write to kernel memory.

Name of the Vulnerable Software and Affected Versions: iPadOS versions prior to 17.7.3 watchOS versions prior to 11.2 tvOS versions prior to 18.2 macOS Sequoia versions prior to 15.2 iOS versions prior to 18.2 iPadOS versions prior to 18.2 macOS Ventura versions prior to 13.7.2 macOS Sonoma versions prior to 14.7.2 Description: A race condition was addressed with improved locking, which may have allowed an application to leak sensitive kernel state information. Recommendations: For iPadOS versions prior to 17.7.3, update to iPadOS 17.7.3. For watchOS versions prior to 11.2, update to watchOS 11.2. For tvOS versions prior to 18.2, update to tvOS 18.2. For macOS Sequoia versions prior to 15.2, update to macOS Sequoia 15.2. For iOS versions prior to 18.2, update to iOS 18.2. For iPadOS versions prior to 18.2, update to iPadOS 18.2. For macOS Ventura versions prior to 13.7.2, update to macOS Ventura 13.7.2. For macOS Sonoma versions prior to 14.7.2, update to macOS Sonoma 14.7.2.

A type confusion issue was addressed with improved memory handling. An attacker with user privileges may be able to read kernel memory due to information leakage caused by an initial 4-byte load in the XNU kernel.

The issue was addressed with improved memory handling. An attacker that has already achieved kernel code execution may be able to bypass kernel memory protections.

An out-of-bounds write issue was addressed with improved input validation, allowing an app to potentially execute arbitrary code with kernel privileges. The issue is related to a buffer overflow in the XNU kernel, specifically in the `sbconcat mbufs` function, where ` MSIZE` was used instead of `MLEN`.

A type confusion issue in the kernel of macOS, iOS, and iPadOS allows a remote user to execute arbitrary code. This issue is related to an error in type conversion. The estimated number of potentially affected devices is not specified.