CVE-2023-38606

Apple Multiple Products Kernel Unspecified

5.5 MEDIUMActively exploited (CISA KEV)EPSS 2.90%

Published26 Jul 2023
Added to CISA KEV26 Jul 2023
Remediation due16 Aug 2023

Description

This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeUnchanged

ConfidentialityNone

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected products

Apple iPadOS≥ 16.0 < 16.6 · < 15.7.8

Apple iPhone OS≥ 16.0 < 16.6 · < 15.7.8

Apple macOS≥ 11.0 < 11.7.9 · ≥ 12.0.0 < 12.6.8 · ≥ 13.0 < 13.5

Apple Tvos< 16.6

Apple Watchos< 9.6

Remediation

Fixed in

Apple iPadOS≥ 16.6

Apple iPhone OS≥ 16.6

Apple macOS≥ 11.7.9

Apple Tvos≥ 16.6

Apple Watchos≥ 9.6

Patch & vendor advisories

References

https://support.apple.com/en-us/HT213841Vendor Advisory
https://support.apple.com/en-us/HT213842Vendor Advisory
https://support.apple.com/en-us/HT213843Vendor Advisory
https://support.apple.com/en-us/HT213844Vendor Advisory
https://support.apple.com/en-us/HT213845Vendor Advisory
https://support.apple.com/en-us/HT213846Vendor Advisory
https://support.apple.com/en-us/HT213848Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38606US Government Resource

Frequently asked

Is CVE-2023-38606 being actively exploited?

Yes. CVE-2023-38606 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 26 Jul 2023.

How severe is CVE-2023-38606?

CVE-2023-38606 has a CVSS 3.1 base score of 5.5, rated medium. EPSS estimates a 2.90% probability of exploitation.

Which products are affected by CVE-2023-38606?

Affected products include Apple iPadOS, Apple iPhone OS, Apple macOS, Apple Tvos, Apple Watchos.

How do I fix CVE-2023-38606?

Upgrade affected software to a fixed version, for example Apple iPadOS 16.6, Apple iPhone OS 16.6, Apple macOS 11.7.9 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-38606 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.