CVE-2023-27952: Race Condition
Published Mar 27, 2023
·Updated
A race condition was addressed with improved locking. This issue is fixed in macOS Ventura 13.3. An app may bypass Gatekeeper checks
Other sources
Accounts. The issue was addressed with improved checks.
— Apple
AirDrop. This issue was addressed through improved state management.
— Apple
AMD. A buffer overflow issue was addressed with improved memory handling.
— Apple
AMD. The issue was addressed with improved bounds checks.
— Apple
apache. This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.
— Apple
Credit
Csaba Fitzl@@theevilbit(Offensive Security), IES Red Team(ByteDance), Linwz(DEVCORE), Yeto, Csaba Fitzl@@theevilbit(Kandji), Mickey Jin@@patch1t, Michael DePlante@@izobashi(Trend Micro Zero Day Initiative), CertiK SkyFall Team, D4m0n, Amir Bazine(CrowdStrike Counter Adversary Operations), Karsten König(CrowdStrike Counter Adversary Operations), CVE-2024-2004, CVE-2024-2379, CVE-2024-2398, CVE-2024-2466, an anonymous researcher, Yann Gascuel(Alter Solutions), w0wbox, CVE-2023-6277, CVE-2023-52356, Yisumi, Junsung Lee(Trend Micro Zero Day Initiative), (CrowdStrike Counter Adversary Operations), Gandalf4a, Wang Yu(Cyberserval), Ye Zhang@@VAR10CK(Baidu Security), sqrtpwn, Minghao Lin(Zhejiang University), Jiaxun Zhu(Zhejiang University), Patrick Wardle(DoubleYou), CVE-2024-40805, Rodolphe BRUNETTI@@eisw0lf, Adam M., CVE-2024-6387, Pedro Tôrres@@t0rr3sp3dr0, Zhongquan Li@@Guluisacat(Dawn Security Lab of JingDong), Mickey Jin@@patch1t(Kandji), (Kandji), Mateen Alinaghi, Claudio Bozzato(Cisco Talos), Francesco Benvenuto(Cisco Talos), Yadhu Krishna M(Cyber Security At Suma Soft Pvt), Narendra Bhati(Cyber Security At Suma Soft Pvt), Manager(Cyber Security At Suma Soft Pvt), Pune (India), Wojciech Regula(SecuRing), (Dawn Security Lab of JingDong), Kirin@@Pwnrin, Joshua Jones, Jiwon Park, Marcio Almeida(Tanto Security), Bistrit Dahal, Srijan Poudel, Jiahui Hu (梅零落)(NorthSea), Meng Zhang (鲸落)(NorthSea), Arsenii Kostromin (0x3c3e), ajajfxhj, Huang Xilin(Ant Group Light), Maksymilian Motyl, Johan Carlsson (joaxcar), Seunghyun Lee@@0x10n(KAIST Hacking Lab working with Trend Micro Zero Day Initiative), CVE-2024-4558, Matthew Butler, Gary Kwong, Andreas Jaegersberger, Ro Achterberg, Zweig(Kunlun Lab), Zhuowei Zhang, developStorm, Khiem Tran, Mickey Jin@@patch1t(FFRI Security Inc), Koh M. Nakagawa(FFRI Security Inc), (Offensive Security), Yiğit Can YILMAZ@@yilmazcanyigit, Masahiro Kawada@@kawakatz(GMO Cybersecurity by Ierae), Jubaer Alnazi Jabin(TRS Group Of Companies), (Alibaba Group), Wenchao Li(Alibaba Group), Xiaolong Bai(Alibaba Group), Guilherme Rambo(Best Buddy Apps), Xin Huang@@11iaxH, CVE-2023-0049, CVE-2023-0051, CVE-2023-0054, CVE-2023-0288, CVE-2023-0433, CVE-2023-0512, Gertjan Franken(imec), KU Leuven, hazbinhotel(Trend Micro Zero Day Initiative), Georgy Kucherin@@kucher1n(Kaspersky), Leonid Bezvershenko@@bzvr_(Kaspersky), Boris Larin@@oct0xor(Kaspersky), (Kaspersky), Valentin Pashkov(Kaspersky), Anonymous(Trend Micro Zero Day Initiative), Dohyun Lee@@l33d0hyun(SSD Labs), crixer@@pwning_me(SSD Labs), Aleksandar Nikolic(Cisco Talos), Mikko Kenttälä )@@Turmio_(SensorFu), Jubaer Alnazi(TRS Group of Companies), jzhu(Trend Micro Zero Day Initiative), Meysam Firouzi@@R00tkitSMM(Mbition Mercedes), ryuzaki, Murray Mike, Pan ZhenPeng@@Peterpan0927(STAR Labs SG Pte), Félix Poulin-Bélanger, David Pan Ogea, Xinru Chi(Pangu Lab), Ned Williamson(Google Project Zero), Adam Doupé(ASU SEFCOM), an anonymous researcher(Red Canary), Brandon Dalton@@partyD0lphin(Red Canary), Milan Tenk(F), (F), Arthur Valiev(F), ABC Research s.r.o., Mohamed Ghannam@@_simo36, Wojciech Reguła@@_r3ggi(SecuRing), Chan Shue Long(Offensive Security), Rıza Sabuncu@@rizasabuncu, JeongOhKyea, Tingting Yin(Tsinghua University), Junoh Lee at Theori, CVE-2022-43551, CVE-2022-43552
Affected Software
3 affected componentsFixes available
Apple macOS<14.6
14.6
macOS Ventura<13.3
13.3
macOS<13.3
Event History
Mar 27, 2023
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Updated
via Apple·12:00 AM
DescriptionWeakness
May 8, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
08:15 PM
Description
Jul 29, 2024
Updated
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2024-40804
- CVE-2023-38709
- CVE-2024-24795
- CVE-2024-27316
- CVE-2024-40783
- CVE-2024-40774
- CVE-2024-40814
- CVE-2024-40775
- CVE-2024-27877
- CVE-2024-27878
- CVE-2024-40799
- CVE-2024-27873
- CVE-2024-2004
- CVE-2024-2379
- CVE-2024-2398
- CVE-2024-2466
- CVE-2024-40827
- CVE-2024-40815
- CVE-2024-40795
- CVE-2023-6277
- CVE-2023-52356
- CVE-2024-40806
- CVE-2024-40777
- CVE-2024-40784
- CVE-2024-27863
- CVE-2024-40816
- CVE-2024-40788
- CVE-2024-40803
- CVE-2024-40805
- CVE-2024-40832
- CVE-2024-40796
- CVE-2024-6387
- CVE-2024-40781
- CVE-2024-40802
- CVE-2024-40823
- CVE-2024-27882
- CVE-2024-27883
- CVE-2024-40778
- CVE-2024-40800
- CVE-2023-27952
- CVE-2024-40817
- CVE-2024-40824
- CVE-2024-27871
- CVE-2024-27881
- CVE-2024-40821
- CVE-2024-40798
- CVE-2024-27872
- CVE-2024-27862
- CVE-2024-40833
- CVE-2024-40835
- CVE-2024-40836
- CVE-2024-40807
- CVE-2024-40834
- CVE-2024-40809
- CVE-2024-40812
- CVE-2024-40787
- CVE-2024-40793
- CVE-2024-40818
- CVE-2024-40822
- CVE-2024-40828
- CVE-2024-40811
- CVE-2024-40776
- CVE-2024-40782
- CVE-2024-40779
- CVE-2024-40780
- CVE-2024-40785
- CVE-2024-40789
- CVE-2024-4558
- CVE-2024-40794
- CVE-2023-32436
- CVE-2023-27968
- CVE-2023-28209
- CVE-2023-28210
- CVE-2023-28211
- CVE-2023-28212
- CVE-2023-28213
- CVE-2023-28214
- CVE-2023-28215
- CVE-2023-32356
- CVE-2023-23532
- CVE-2023-23527
- CVE-2023-27931
- CVE-2023-28179
- CVE-2023-42830
- CVE-2023-27951
- CVE-2023-27961
- CVE-2023-23543
- CVE-2023-23534
- CVE-2023-27955
- CVE-2023-27936
- CVE-2023-40398
- CVE-2023-28181
- CVE-2023-32426
- CVE-2022-43551
- CVE-2022-43552
- CVE-2023-27934
- CVE-2023-28180
- CVE-2023-27935
- CVE-2023-27953
- CVE-2023-27958
- CVE-2023-40433
- CVE-2023-28190
- CVE-2023-23537
- CVE-2023-28195
- CVE-2023-27956
- CVE-2023-32366
- CVE-2023-27937
- CVE-2023-23526
- CVE-2023-27928
- CVE-2023-27939
- CVE-2023-27947
- CVE-2023-27948
- CVE-2023-42862
- CVE-2023-42865
- CVE-2023-23535
- CVE-2023-27929
- CVE-2023-27946
- CVE-2023-27957
- CVE-2023-32378
- CVE-2023-28187
- CVE-2023-27941
- CVE-2023-28199
- CVE-2023-23536
- CVE-2023-23514
- CVE-2023-27969
- CVE-2023-27933
- CVE-2023-28200
- CVE-2023-27943
- CVE-2023-23525
- CVE-2023-40383
- CVE-2023-41075
- CVE-2023-28189
- CVE-2023-28197
- CVE-2023-27950
- CVE-2023-27949
- CVE-2023-28182
- CVE-2023-23538
- CVE-2023-27962
- CVE-2023-23523
- CVE-2023-27942
- CVE-2023-32362
- CVE-2023-23533
- CVE-2023-28178
- CVE-2023-27966
- CVE-2023-27963
- CVE-2023-23542
- CVE-2023-28192
- CVE-2023-28188
- CVE-2023-0049
- CVE-2023-0051
- CVE-2023-0054
- CVE-2023-0288
- CVE-2023-0433
- CVE-2023-0512
- CVE-2023-32370
- CVE-2023-28198
- CVE-2023-32435
- CVE-2023-27932
- CVE-2023-27954
- CVE-2014-1745
- CVE-2023-32358
- CVE-2023-28201
- CVE-2023-27944
- CVE-2024-54564
- CVE-2024-44306
- CVE-2024-44307
- CVE-2024-44141
- CVE-2024-44199
- CVE-2024-40810
- CVE-2024-44305
- CVE-2024-44205
- CVE-2024-54551
- CVE-2024-44185
- CVE-2024-44206
- CVE-2023-28207
Frequently Asked Questions
1
What is CVE-2023-27952?
CVE-2023-27952 is a vulnerability in Safari that allows an app to bypass Gatekeeper checks due to a race condition.
2
What is the severity of CVE-2023-27952?
The severity of CVE-2023-27952 is medium, with a severity value of 4.7.
3
How was CVE-2023-27952 addressed?
CVE-2023-27952 was addressed by improving locking to fix the race condition in Safari.
4
Which operating systems are affected by CVE-2023-27952?
CVE-2023-27952 affects macOS Ventura 13.3 and Apple iPadOS up to version 13.3.
5
How can I fix the CVE-2023-27952 vulnerability?
To fix the CVE-2023-27952 vulnerability, update your macOS Ventura to version 13.3 or later and update your Apple iPadOS to version 13.3 or later.