CVE-2022-22675: Apple macOS Out-of-Bounds Write Vulnerability
Published Mar 31, 2022
·Updated
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.3.1, iOS 15.4.1 and iPadOS 15.4.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
Credit
an anonymous researcher, Lockheed Martin Red Team, Jeremy Brown(Trend Micro Zero Day Initiative), Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), Qi Sun(Trend Micro), Ye Zhang@@co0py_Cat(Baidu Security), Robert Ai(Trend Micro), Arsenii Kostromin (0x3c3e), Yonghwi Jin@@jinmo123(Theori), Linus Henze(Pinauten GmbH), Liu Long(Ant Security Light), Jack Dates(RET2 Systems Inc), Antonio Zekic@@antoniozekic, Jeonghoon Shin(Theori working with Trend Micro Zero Day Initiative), Peter Nguyễn Vũ Hoàng@@peternguyen14(STAR Labs), Ned Williamson(Google Project Zero), @@gorelics(BreakPoint), (BreakPoint), Ron Masas(BreakPoint), Wojciech Reguła@@_r3ggi(SecuRing), Arsenii Kostromin (0x3c3e)(Microsoft), Jonathan Bar Or(Microsoft), Zhipeng Huo@@R3dF09(Tencent Security Xuanwu Lab), Yuebin Sun@@yuebinsun2020(Tencent Security Xuanwu Lab), Max Shavrick@@_mxms(the Google Security Team), Zubair Ashraf(Crowdstrike), CVE-2022-0778, CVE-2022-23308, Mickey Jin@@patch1t, @@gorelics, Peter Nguyễn Vũ Hoàng(STAR Labs), Felix Poulin-Belanger, Antonio Cheong Yu Xuan(YCISCQ), CVE-2021-4136, CVE-2021-4166, CVE-2021-4173, CVE-2021-4187, CVE-2021-4192, CVE-2021-4193, CVE-2021-46059, CVE-2022-0128, Heige(KnownSec 404 Team), Bo Qu(Palo Alto Networks), Scarlet Raine, Wang Yu(Cyberserval), CVE-2022-0530, Tavis Ormandy, CVE-2021-45444, CVE-2021-44224, CVE-2021-44790, CVE-2022-22719, CVE-2022-22720, CVE-2022-22721
Affected Software
13 affected componentsFixes available
Apple macOS Big Sur<11.6.6
11.6.6
Apple tvOS<15.5
15.5
Apple WatchOS<8.6
8.6
Apple macOS Monterey<12.3.1
12.3.1
Apple macOS
Apple iOS<15.4.1
15.4.1
Apple iPadOS<15.4.1
15.4.1
Apple iPadOS<15.4.1
Apple iPhone OS<15.4.1
Apple macOS>=11.0<11.6.6
Apple macOS>=12.0.0<12.3.1
Apple tvOS<15.5
Apple WatchOS<8.6
Event History
Apr 4, 2022
CVE Published
via CISA·12:00 AM
Known Exploited
via CISA·12:00 AM
May 16, 2022
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
May 26, 2022
CVE Published
via MITRE·05:44 PM
Data Sourced
via MITRE·05:44 PM
DescriptionWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2022-22675?
CVE-2022-22675 is an out-of-bounds write vulnerability in Apple macOS.
2
How does CVE-2022-22675 affect Apple macOS?
CVE-2022-22675 affects Apple macOS by allowing an attacker to perform an out-of-bounds write.
3
Is CVE-2022-22675 actively exploited?
Apple is aware of a report that CVE-2022-22675 may have been actively exploited.
4
How can I fix CVE-2022-22675 on macOS Big Sur?
Update macOS Big Sur to version 11.6.6 to fix CVE-2022-22675.
5
How can I fix CVE-2022-22675 on macOS Monterey?
Update macOS Monterey to version 12.3.1 to fix CVE-2022-22675.