CVE-2022-22620

Deeper analysis

A use after free vulnerability addressed through improved memory management affects WebKit in Safari 15.3 and earlier, as well as the corresponding web content rendering components in macOS Monterey prior to 12.2.1, iOS prior to 15.3.1, and iPadOS prior to 15.3.1. The flaw is tracked as CWE-416 and carries a CVSS 3.1 score of 8.8, reflecting network attack vectors that require no privileges but do involve user interaction.

An attacker can exploit the issue by serving maliciously crafted web content that triggers the use-after-free condition during rendering, resulting in arbitrary code execution within the context of the affected process. Because the vector is web content, exploitation can occur when a user visits a compromised or attacker-controlled site in an unpatched browser or application embedding WebKit.

Apple security updates HT213091, HT213092, and HT213093, along with corresponding Gentoo advisories, direct users to install the fixed versions of macOS Monterey 12.2.1, iOS 15.3.1, iPadOS 15.3.1, and Safari 15.3 to remediate the flaw.

Apple has stated that the vulnerability may have been actively exploited in the wild at the time of disclosure. The associated EPSS score rose materially from low values after publication to a peak of 0.1817 on 2023-01-01 before receding to the current 0.0402, indicating that exploitation interest increased post-disclosure.