CVE-2022-22675
Published: 26 May 2022
Summary
CVE-2022-22675 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Apple Macos. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 18.9% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2022-22675 is an out-of-bounds write vulnerability that was addressed with improved bounds checking. It affects multiple Apple platforms prior to the listed versions, specifically tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.3.1, iOS 15.4.1, and iPadOS 15.4.1. The flaw resides in a component that permits an application to perform memory operations outside expected bounds.
An attacker who can execute a malicious application on an affected device can leverage the issue to achieve arbitrary code execution with kernel privileges. The CVSS vector indicates a local attack requiring user interaction but no elevated privileges, resulting in high impact to confidentiality, integrity, and availability.
The referenced Apple security updates for each platform detail the fixes and advise installing tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.3.1, iOS 15.4.1, or iPadOS 15.4.1 to mitigate the vulnerability.
Apple has stated awareness of reports that the issue may have been actively exploited. The associated EPSS score remained flat at a peak and current value of 0.0144.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-27820
Vulnerability details
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.3.1, iOS 15.4.1 and iPadOS 15.4.1. An application may be able to execute arbitrary code…
more
with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
- CWE(s)
- KEV Date Added
- 04 April 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of vendor patches that implement the improved bounds checking fixing the out-of-bounds write.
Requires memory-protection mechanisms that can block unauthorized writes and kernel-level code execution attempted via this flaw.
Enables monitoring for anomalous local behavior or exploitation attempts that leverage the out-of-bounds write on affected Apple platforms.