CVE-2024-23265: 
macOS vulnerability analysis and mitigation

A memory corruption vulnerability (CVE-2024-23265) was discovered affecting multiple Apple operating systems. The vulnerability was identified by Xinru Chi of Pangu Lab and fixed in macOS Monterey 12.7.4, macOS Ventura 13.6.5, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, and tvOS 17.4 (Apple Security).

The vulnerability is a memory corruption issue in the kernel that was addressed with improved locking mechanisms. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H by NIST NVD. Additionally, CISA-ADP assigned it a CVSS score of 9.8 (Critical) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

An app may be able to cause unexpected system termination or write kernel memory. This could potentially allow an attacker to execute arbitrary code with kernel privileges (Apple Security).

Apple has released security updates to address this vulnerability across their affected operating systems. Users should update to macOS Monterey 12.7.4, macOS Ventura 13.6.5, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, or tvOS 17.4 as appropriate for their devices (Apple Security).