CVE-2022-48618: Apple Multiple Products Memory Corruption Vulnerability
First published: Tue Dec 13 2022(Updated: )
Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities to bypass Pointer Authentication.
Credit: Apple Apple Apple Apple product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple watchOS | <9.2 | 9.2 |
| Apple tvOS | <16.2 | 16.2 |
| Apple macOS Ventura | <13.1 | 13.1 |
| Fortinet FortiOS | ||
| Apple Multiple Products | ||
| Apple iOS | <16.2 | 16.2 |
| Apple iPadOS | <16.2 | 16.2 |
| Apple iPadOS | <16.2 | |
| Apple iPhone OS | <16.2 | |
| Apple macOS | >=13.0<13.1 | |
| Apple tvOS | <16.2 | |
| Apple watchOS | <9.2 |
Remedy
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://support.apple.com/en-us/HT213536 (Advisory)
- https://support.apple.com/en-us/HT213535 (Advisory)
- https://support.apple.com/en-us/HT213532 (Advisory)
- https://www.bleepingcomputer.com/news/security/cisa-warns-of-patched-iphone-kernel-bug-now-exploited-in-attacks/
- https://www.bleepingcomputer.com/news/security/new-fortinet-rce-bug-is-actively-exploited-cisa-confirms/
- https://support.apple.com/en-us/HT213530,
- https://support.apple.com/en-us/HT213532,
- https://support.apple.com/en-us/HT213535,
- https://support.apple.com/en-us/HT213530 (Advisory)
- https://support.apple.com/kb/HT213530
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2022-46717
- CVE-2022-42843
- CVE-2022-46694
- CVE-2022-42865
- CVE-2022-42859
- CVE-2022-46693
- CVE-2022-42864
- CVE-2022-46690
- CVE-2022-42837
- CVE-2022-46689
- CVE-2022-42842
- CVE-2022-42845
- CVE-2022-48618
- CVE-2022-40303
- CVE-2022-40304
- CVE-2022-42855
- CVE-2022-46695
- CVE-2022-42849
- CVE-2022-46703
- CVE-2022-42866
- CVE-2022-46705
- CVE-2022-42867
- CVE-2022-46691
- CVE-2022-46692
- CVE-2022-42852
- CVE-2022-46696
- CVE-2022-46700
- CVE-2022-46698
- CVE-2022-46699
- CVE-2022-42863
- CVE-2022-42848
- CVE-2022-42851
- CVE-2022-46701
- CVE-2022-42856
- CVE-2022-42858
- CVE-2022-42847
- CVE-2022-42854
- CVE-2022-42853
- CVE-2022-35252
- CVE-2022-32942
- CVE-2022-46720
- CVE-2022-46710
- CVE-2022-46697
- CVE-2022-42861
- CVE-2022-42839
- CVE-2022-46716
- CVE-2022-46704
- CVE-2022-32943
- CVE-2022-42840
- CVE-2022-42862
- CVE-2022-24836
- CVE-2022-29181
- CVE-2022-46718
- CVE-2022-32919
- CVE-2022-46725
- CVE-2022-42841
- CVE-2024-21762
- CVE-2024-23108
- CVE-2024-23109
- CVE-2023-34992
- CVE-2022-42475
- CVE-2023-27997
- CVE-2022-46702
- CVE-2022-42850
- CVE-2022-42846
- CVE-2022-42844
- agent/type
- agent/first-publish-date
- agent/author
- collector/apple-support
- source/Apple
- agent/software-canonical-lookup
- agent/weakness
- agent/remedy
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2022-48618
- alias/CVE-2024-23222
- alias/CVE-2023-42916
- alias/CVE-2023-42917
- agent/severity
- agent/event
- agent/news-ai
- agent/softwarecombine
- alias/CVE-2024-21762
- alias/CVE-2024-23108
- alias/CVE-2024-23109
- alias/CVE-2023-34992
- alias/CVE-2022-42475
- alias/CVE-2023-27997
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/description
- agent/last-modified-date
- agent/title
- agent/software-canonical-lookup-request
- agent/references
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/apple
- canonical/apple watchos
- canonical/apple tvos
- canonical/apple macos ventura
- vendor/fortinet
- canonical/fortinet fortios
- canonical/apple multiple products
- canonical/apple ios
- canonical/apple ipados