Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-03-30

[ Description ]Official description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.8.1 and iPadOS 14.8.1, iOS 15.1 and iPadOS 15.1. A malicious application may be able to execute arbitrary code with kernel privileges.

CISA: Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 20 Apr 2023): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• support.apple.com/en-us/HT212867Vendor Advisory
• support.apple.com/en-us/HT212868Vendor Advisory
• support.apple.com/kb/HT212872Vendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource