CVE-2022-32924

Vulnerability

A memory handling issue exists in Apple's kernel that allows an app to execute arbitrary code with kernel privileges. The vulnerability affects tvOS before 16.1, macOS Big Sur before 11.7, macOS Ventura before 13, watchOS before 9.1, iOS before 16.1, iPadOS before 16, and macOS Monterey before 12.6 [2].

Exploitation

An attacker must have an app installed on the device. The app can trigger the memory handling flaw to gain kernel-level code execution without requiring additional user interaction beyond installing the malicious app [2].

Impact

Successful exploitation allows the app to execute arbitrary code with kernel privileges, giving full control over the device's operating system and data [2].

Mitigation

Apple has addressed the issue in tvOS 16.1, macOS Big Sur 11.7, macOS Ventura 13, watchOS 9.1, iOS 16.1, iPadOS 16, and macOS Monterey 12.6. These updates were released on October 24, 2022 (for most versions) and September 12, 2022 (for macOS Monterey 12.6 and macOS Big Sur 11.7) [2]. No workarounds are available; users should update to the latest versions.