CVE-2023-38606

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

This vulnerability stems from insufficient state management in the kernel, allowing an app to modify sensitive kernel state. It affects a range of Apple platforms prior to the listed updates, including macOS Monterey 12.6.8, macOS Big Sur 11.7.9, macOS Ventura 13.5, iOS 15.7.8, iOS 16.6, iPadOS 15.7.8, iPadOS 16.6, tvOS 16.6, and watchOS 9.6. The issue carries a CVSS score of 5.5, reflecting local attack vector, low complexity, no required privileges, and required user interaction, with high impact on integrity but none on confidentiality or availability.

An attacker with the ability to run an app on an affected device can exploit the flaw to alter protected kernel state. Because the vector is local and user interaction is needed, the scenario typically involves convincing a target to install or execute a malicious application, after which the app can tamper with kernel data structures without elevated privileges.

Apple's security advisories for the referenced updates state that the issue was resolved through improved state management and recommend installing the patches for macOS Monterey 12.6.8 and later, iOS 16.6 and later, and the corresponding releases for other platforms. The company notes awareness of active exploitation against iOS versions before 15.7.1. The current EPSS score remains low at 0.0010 with no indicated rise.