CVE-2023-32354

Vulnerability

An out-of-bounds read vulnerability exists in the kernel of Apple operating systems. The issue was addressed with improved input validation, as noted in the official description. It affects versions prior to iOS 16.5, iPadOS 16.5, tvOS 16.5, and watchOS 9.5 [1][2][3].

Exploitation

An attacker would need to have an app installed on the device to trigger the bug. The app can then read out-of-bounds kernel memory, potentially bypassing normal memory protections. No additional privileges or user interaction beyond installing the app are required.

Impact

Successful exploitation allows an app to disclose kernel memory, which could lead to the exposure of sensitive information normally protected by the kernel's memory isolation. This is a confidentiality impact, potentially revealing private data, kernel structures, or other secrets.

Mitigation

Apple released fixes in iOS 16.5 and iPadOS 16.5 (released May 18, 2023) [1], tvOS 16.5 [2], and watchOS 9.5 [3]. Users should update their devices to these or later versions. No workarounds are documented.