CVE-2022-46689
Published: 15 December 2022
Summary
CVE-2022-46689 is a high-severity Race Condition (CWE-362) vulnerability in Apple Macos. Its CVSS base score is 7.0 (High).
Operationally, ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A race condition vulnerability, tracked as CVE-2022-46689 and assigned CWE-362, affects multiple Apple operating systems including tvOS prior to 16.2, macOS Monterey prior to 12.6.2, macOS Ventura prior to 13.1, macOS Big Sur prior to 11.7.2, iOS and iPadOS prior to 15.7.2 and 16.2, and watchOS prior to 9.2. The flaw was addressed by adding validation checks, and successful exploitation could allow an application to run arbitrary code with kernel-level privileges. The issue carries a CVSS 3.1 score of 7.0 reflecting local attack vector, high attack complexity, and no privileges required.
An attacker would need to supply a malicious application that triggers the race condition on an affected device. Because the vector requires user interaction to install or run the app, the impact is limited to scenarios where the victim executes attacker-controlled code, after which kernel privileges could be obtained to bypass system protections or access sensitive resources.
Public advisories published via the referenced full-disclosure lists confirm that the listed operating-system updates resolve the issue by strengthening validation around the race window. No other mitigations such as configuration changes are described in the available references.
The associated EPSS score has remained near 0.85 with negligible movement between current and peak values, indicating sustained but not newly emerging exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-49478
Vulnerability details
A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app may…
more
be able to execute arbitrary code with kernel privileges.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Accurate timestamps from internal clocks enable detection of race conditions by providing reliable event ordering in audit logs.
Coordination of concurrent security activities reduces the probability that shared resources will be accessed simultaneously without proper synchronization.