CVE-2022-42864
Published: 15 December 2022
Summary
CVE-2022-42864 is a high-severity Race Condition (CWE-362) vulnerability in Apple Macos. Its CVSS base score is 7.0 (High).
Operationally, ranked in the top 8.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-42864 is a race condition vulnerability, tracked under CWE-362, that was addressed with improved state handling in multiple Apple operating systems. Affected platforms include versions of tvOS prior to 16.2, macOS Monterey prior to 12.6.2, macOS Ventura prior to 13.1, macOS Big Sur prior to 11.7.2, iOS and iPadOS prior to 15.7.2 and 16.2, and watchOS prior to 9.2. The flaw carries a CVSS 3.1 score of 7.0 reflecting local attack vector, high complexity, and no required privileges or user interaction beyond running an app.
An attacker who can execute a malicious application on an impacted device may exploit the race condition to achieve arbitrary code execution with kernel-level privileges, though the high complexity requirement limits the likelihood of reliable success without precise timing conditions.
Apple published fixes for the issue in the versions noted above, with corresponding advisories appearing in December 2022 full-disclosure mailings. The associated EPSS scores have remained low and essentially flat, with a current value of 0.0740 against a peak of 0.0774.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-45927
Vulnerability details
A race condition was addressed with improved state handling. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app…
more
may be able to execute arbitrary code with kernel privileges.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Accurate timestamps from internal clocks enable detection of race conditions by providing reliable event ordering in audit logs.
Coordination of concurrent security activities reduces the probability that shared resources will be accessed simultaneously without proper synchronization.