CVE-2023-42893

Vulnerability

CVE-2023-42893 is a permissions issue affecting Apple operating systems. The vulnerability existed in the system's handling of protected user data, where an app could bypass permission checks and access sensitive information. The issue was addressed by removing vulnerable code and adding additional checks. The affected versions include macOS Monterey 12.7.2, macOS Ventura 13.6.3, macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, iOS 16.7.3 and iPadOS 16.7.3, tvOS 17.2, and watchOS 10.2 [3][4].

Exploitation

An attacker would need to have the ability to run a crafted app on the affected device. No other special privileges or network access are required beyond the ability to install and execute the app. The app could then exploit the permissions issue to access protected user data without proper authorization. The exact exploitation sequence is not detailed in available references [1][2][3][4].

Impact

Successful exploitation allows an app to access protected user data, which may include sensitive information such as contacts, photos, or other private data. The impact is a breach of user privacy (confidentiality), and the attacker gains the privilege level of the app itself, which can then access data normally protected by system permissions [1][2][3][4].

Mitigation

Apple has released patches for this vulnerability as part of the following updates: macOS Monterey 12.7.2, macOS Ventura 13.6.3, macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, iOS 16.7.3 and iPadOS 16.7.3, tvOS 17.2, and watchOS 10.2. Users should update their devices to these or later versions. As of the publication date (March 28, 2024), these fixes were available. No workarounds have been disclosed, and the vulnerability is not listed on the CISA KEV catalog.