PT-2023-4047 · Apple · Apple Macos+5

Boris Larin + 7 · Published 2023-07-24 · Updated 2026-05-17 · CVE-2023-38606

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:L/AC:L/Au:S/C:P/I:C/A:C

Name of the Vulnerable Software and Affected Versions macOS Monterey versions prior to 12.6.8 iOS versions prior to 15.7.8 iPadOS versions prior to 15.7.8 iOS versions prior to 16.6 iPadOS versions prior to 16.6 tvOS versions prior to 16.6 macOS Big Sur versions prior to 11.7.9 macOS Ventura versions prior to 13.5 watchOS versions prior to 9.6

Description An issue exists where an app may be able to modify sensitive kernel state due to a memory out-of-bounds operation. This allows unauthorized access to sensitive information and full control of the device by bypassing kernel memory hardware protections. The exploitation involves writing data, destination addresses, and data hashes into undocumented and unused hardware registers (MMIO registers) within Apple SoCs. There are reports that this issue was actively exploited against versions of iOS released before iOS 15.7.1.

Recommendations Update macOS Monterey to version 12.6.8. Update iOS to version 15.7.8 or 16.6. Update iPadOS to version 15.7.8 or 16.6. Update tvOS to version 16.6. Update macOS Big Sur to version 11.7.9. Update macOS Ventura to version 13.5. Update watchOS to version 9.6.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2023-04345

CVE-2023-38606

Affected Products

Apple Macos

Imessage

Ios

Ipados

Tvos

Watchos

References · 95

• https://support.apple.com/en-us/HT213844 · Vendor Advisory
• https://support.apple.com/en-us/HT213846 · Vendor Advisory
• https://support.apple.com/en-us/HT213848 · Vendor Advisory
• https://support.apple.com/en-us/HT213843 · Vendor Advisory
• https://support.apple.com/en-us/HT213845 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38606 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/697139/?sphrase_id=45551 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38606 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04345 · Security Note
• https://support.apple.com/en-us/HT213843,https://support.apple.com/en-us/HT213844,https://support.apple.com/en-us/HT213845,https://support.apple.com/en-us/HT213846,https://support.apple.com/en-us/HT213848 · Security Note
• https://twitter.com/KLrecruitNA/status/1744791774558601258 · Twitter Post
• https://twitter.com/aletihadae/status/1695784140275167483 · Twitter Post
• https://twitter.com/TWiT/status/1742376275107250591 · Twitter Post
• https://twitter.com/usman_iq/status/1745023659792531928 · Twitter Post
• https://twitter.com/_hhmbz1/status/1695808565674418224 · Twitter Post