CVE-2023-32354: Input Validation

Q: What is CVE-2023-32354?

CVE-2023-32354 is a vulnerability in IOSurfaceAccelerator where an out-of-bounds read can occur due to improved input validation.

Q: What is the severity of CVE-2023-32354?

The severity of CVE-2023-32354 is medium with a severity value of 5.5.

Q: Which devices and operating systems are affected by CVE-2023-32354?

CVE-2023-32354 affects Apple iPhone OS, Apple iPadOS, Apple tvOS, and Apple watchOS. The affected versions are up to, but not including, iOS, iPadOS, tvOS 16.5 and watchOS 9.5 respectively.

Q: How can the CVE-2023-32354 vulnerability be fixed?

To fix the CVE-2023-32354 vulnerability, update to watchOS 9.5, tvOS 16.5, iOS 16.5, or iPadOS 16.5.

Q: Can the CVE-2023-32354 vulnerability lead to disclosure of kernel memory?

Yes, an app exploiting the CVE-2023-32354 vulnerability may be able to disclose kernel memory.

Published May 18, 2023

Updated

Accessibility. A privacy issue was addressed with improved private data redaction for log entries.

Other sources

Accessibility. This issue was addressed with improved checks.

— Apple

Accounts. A permissions issue was addressed with improved redaction of sensitive information.

— Apple

An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, iOS 16.5 and iPadOS 16.5. An app may be able to disclose kernel memory.

Apple Neural Engine. The issue was addressed with improved memory handling.

— Apple

AppleMobileFileIntegrity. This issue was addressed with improved entitlements.

— Apple

Credit

Mohamed GHANNAM@@_simo36, Adam M., Mickey Jin@@patch1t, Zitong Wu (吴梓桐)(Zhuhai No), Meysam Firouzi@@R00tkitSMM(Mbition Mercedes), Meysam Firouzi@@R00tkitsmm(Trend Micro Zero Day Initiative), Linus Henze(Pinauten GmbH), CertiK SkyFall Team(Pinauten GmbH), 08Tc3wBB(Jamf), Adam Doupé(ASU SEFCOM), Eloi Benoist-Vanderbeken@@elvanderb(Synacktiv), Wojciech Reguła@@_r3ggi(SecuRing), Gergely Kalman@@gergely_kalman, Thijs Alkemade(Computest Sector 7), Julian Szulc, Yiğit Can YILMAZ@@yilmazcanyigit(FFRI Security Inc), Koh M. Nakagawa(FFRI Security Inc), Kirin@@Pwnrin(Offensive Security), Jeff Johnson (underpassapp.com)(Offensive Security), (Offensive Security), Csaba Fitzl@@theevilbit(Offensive Security), Kirin@@Pwnrin, Wenchao Li(Alibaba Group), Xiaolong Bai(Alibaba Group), Mickey Jin@@patch1t(Tencent Security Xuanwu Lab), Zhipeng Huo@@R3dF09(Tencent Security Xuanwu Lab), an anonymous researcher, Khiem Tran, Gergely Kalman@@gergely_kalman(SecuRing), Wojciech Regula(SecuRing), Yiğit Can YILMAZ@@yilmazcanyigit, Satish Panduranga, Ivan Fratric(Google Project Zero), Ignacio Sanmillan@@ulexec, Clément Lecigne(Google's Threat Analysis Group), Donncha Ó Cearbhaill(Amnesty International), Pan ZhenPeng@@Peterpan0927(STAR Labs SG Pte), Sergii Kryvoblotskyi(MacPaw Inc), (SecuRing), Wojciech Reguła(SecuRing), OSS-Fuzz(Google Project Zero), (Google Project Zero), Ned Williamson(Google Project Zero), Jonathan Fritz, Jiwon Park, James Duffy (mangoSecure), Amat Cama(Vigilant Labs)

Affected Software

8 affected componentsFixes available

Apple tvOS<16.5

16.5

Apple WatchOS<9.5

9.5

Apple iOS<16.5

16.5

Apple iPadOS<16.5

16.5

Apple iPadOS<16.5

Apple iPhone OS<16.5

Apple tvOS<16.5

Apple WatchOS<9.5

Event History

May 18, 2023

Data Sourced

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Updated

via Apple·12:00 AM

DescriptionWeakness

Updated

via Apple·12:00 AM

Description

Updated

via Apple·12:00 AM

DescriptionWeaknessAffected Software

Updated

via Apple·12:00 AM

Affected Software

Updated

via Apple·12:00 AM

DescriptionAffected Software

Jun 23, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2023-32354?

CVE-2023-32354 is a vulnerability in IOSurfaceAccelerator where an out-of-bounds read can occur due to improved input validation.

What is the severity of CVE-2023-32354?

The severity of CVE-2023-32354 is medium with a severity value of 5.5.

Which devices and operating systems are affected by CVE-2023-32354?

CVE-2023-32354 affects Apple iPhone OS, Apple iPadOS, Apple tvOS, and Apple watchOS. The affected versions are up to, but not including, iOS, iPadOS, tvOS 16.5 and watchOS 9.5 respectively.

How can the CVE-2023-32354 vulnerability be fixed?

To fix the CVE-2023-32354 vulnerability, update to watchOS 9.5, tvOS 16.5, iOS 16.5, or iPadOS 16.5.

Can the CVE-2023-32354 vulnerability lead to disclosure of kernel memory?

Yes, an app exploiting the CVE-2023-32354 vulnerability may be able to disclose kernel memory.

CVE-2023-32354: Input Validation

Other sources

Credit

Affected Software

Event History

Parent advisories

Peer vulnerabilities

Don't miss critical vulnerabilities

Frequently Asked Questions

What is CVE-2023-32354?

What is the severity of CVE-2023-32354?

Which devices and operating systems are affected by CVE-2023-32354?

How can the CVE-2023-32354 vulnerability be fixed?

Can the CVE-2023-32354 vulnerability lead to disclosure of kernel memory?

Company

Resources

Contact