CVE-2022-42790

Vulnerability

A logic issue in the lock screen state management of Apple operating systems allows a user to view restricted content that should be protected by the lock screen. The vulnerability affects macOS Big Sur before 11.7, macOS Monterey before 12.6, macOS Ventura before 13, iOS before 16, iOS 15 before 15.7, and iPadOS before 15.7 [1][2][3][4]. The issue was addressed with improved state management.

Exploitation

An attacker with physical access to a locked device can exploit this vulnerability by performing specific actions to bypass the lock screen. No authentication or user interaction is required beyond the physical access. The exact sequence of steps is not disclosed in the available references.

Impact

Successful exploitation allows the attacker to view restricted content that is normally hidden behind the lock screen, such as notifications, messages, or other sensitive data. This leads to information disclosure of potentially private information.

Mitigation

Apple has released fixes in macOS Big Sur 11.7, macOS Monterey 12.6, macOS Ventura 13, iOS 16, iOS 15.7, and iPadOS 15.7 [1][2][3][4]. Users should update their devices to the latest available versions. No workarounds have been provided by Apple.