CVE-2022-26757
Published: 26 May 2022
Summary
CVE-2022-26757 is a high-severity Use After Free (CWE-416) vulnerability in Apple Mac Os X. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 8.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A use-after-free vulnerability addressed through improved memory management affects the XNU kernel in multiple Apple operating systems. The issue is present in versions prior to tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4, and Security Update 2022-004 Catalina, and carries a CVSS 3.1 score of 7.8 with a local attack vector.
An unauthenticated local application can trigger the flaw to achieve arbitrary code execution with kernel privileges, though successful exploitation requires user interaction such as opening a malicious file or application.
Apple security advisories for the listed updates recommend installing the patches that resolve the memory-management defect. Public references include technical details on an XNU Flow Divert race condition that matches the described use-after-free behavior.
The associated EPSS score has remained flat at 0.0670 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-31307
Vulnerability details
A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4. An application may be…
more
able to execute arbitrary code with kernel privileges.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.