NA

CVE-2023-32434

Published: 23/06/2023 Updated: 25/10/2023
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 0

Vulnerability Summary

An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.5.2, macOS Big Sur 11.7.8, iOS 15.7.7 and iPadOS 15.7.7, macOS Monterey 12.6.7, watchOS 8.8.1, iOS 16.5.1 and iPadOS 16.5.1, macOS Ventura 13.4.1. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apple iphone os

apple ipados

apple macos

apple watchos

Vendor Advisories

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available Recent releases are listed on the Apple security releases page Apple security documents reference vulnerabilities by CVE-ID whe ...
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available Recent releases are listed on the Apple security updates page Apple security documents reference vulnerabilities by CVE-ID&nbsp ...
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available Recent releases are listed on the Apple security updates page Apple security documents reference vulnerabilities by CVE-ID&nbsp ...
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available Recent releases are listed on the Apple security updates page Apple security documents reference vulnerabilities by CVE-ID&nbsp ...
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available Recent releases are listed on the Apple security updates page Apple security documents reference vulnerabilities by CVE-ID&nbsp ...
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available Recent releases are listed on the Apple security updates page Apple security documents reference vulnerabilities by CVE-ID&nbsp ...
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available Recent releases are listed on the Apple security updates page Apple security documents reference vulnerabilities by CVE-ID&nbsp ...
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available Recent releases are listed on the Apple security updates page Apple security documents reference vulnerabilities by CVE-ID&nbsp ...

Github Repositories

kfd, short for kernel file descriptor, is a project to read and write kernel memory on Apple devices.

Quick disclaimer: I have no intention of adding offsets for other devices and iOS versions kfd kfd, short for kernel file descriptor, is a project to read and write kernel memory on Apple devices It leverages various vulnerabilities that can be exploited to obtain dangling PTEs, which will be referred to as a PUAF primitive, short for "physical use-after-free" The

Main Repo For PureKFD

PureKFD - The Purest iOS Customization Toolbox Download • Discord • Twitter Overview PureKFD is a KFD Focused Package Manager for iOS, focusing on iOS versions 140 through 166b1 (excluding 1651) using KFD (CVE-2023-32434) and MDC (CVE-2022-46689) PureKFD allows users to customize their iOS experience through a user-friendly interface, utilizing commun

Quick disclaimer: I have no intention of adding offsets for other devices and iOS versions kfd kfd, short for kernel file descriptor, is a project to read and write kernel memory on Apple devices It leverages various vulnerabilities that can be exploited to obtain dangling PTEs, which will be referred to as a PUAF primitive, short for "physical use-after-free" The

kfd kfd, short for kernel file descriptor, is a project to read and write kernel memory on Apple devices It leverages various vulnerabilities that can be exploited to obtain dangling PTEs, which will be referred to as a PUAF primitive, short for "physical use-after-free" Then, it reallocates certain kernel objects inside those physical pages and manipulates them dir

fork for testing

kfd kfd, short for kernel file descriptor, is a project to read and write kernel memory on Apple devices It leverages various vulnerabilities that can be exploited to obtain dangling PTEs, which will be referred to as a PUAF primitive, short for "physical use-after-free" Then, it reallocates certain kernel objects inside those physical pages and manipulates them dir

kfd kfd, short for kernel file descriptor, is a project to read and write kernel memory on Apple devices It leverages various vulnerabilities that can be exploited to obtain dangling PTEs, which will be referred to as a PUAF primitive, short for "physical use-after-free" Then, it reallocates certain kernel objects inside those physical pages and manipulates them dir

kfund (Post-Exploitation) kfund, short for my fun with kfd exploit Supported Device iPhone 14 Pro/Pro Max on iOS 1612 (Currently only working with smith exploit) What you can do with this? utilsm int ResSet16(NSInteger height, NSInteger width); Change resolution via modify comappleiokitIOMobileGraphicsFamilyplist It's safe t

PoC A collection of proof-of-concept codes from DARKNAVY CVE-2023-32434 Target: iOS && macOS Version: before iOS 1651 && macOS 1341 CVE-2023-4863 Target: Chrome Renderer Version: 119060220 Blog Post: Part 1, Part 2

Recent Articles

Apple fixes two new iOS zero-days exploited in attacks on iPhones
BleepingComputer • Lawrence Abrams • 05 Mar 2024

Apple fixes two new iOS zero-days exploited in attacks on iPhones By Lawrence Abrams March 5, 2024 04:34 PM 0 Apple released emergency security updates to fix two iOS zero-day vulnerabilities that were exploited in attacks on iPhones. "Apple is aware of a report that this issue may have been exploited," the company said in an advisory issued on Tuesday. The two bugs were found in the iOS Kernel (CVE-2024-23225) and RTKit (CVE-2024-23296), both allowing attackers with arbitrary kernel r...

Operation Triangulation: The last (hardware) mystery
Securelist • Boris Larin • 27 Dec 2023

Today, on December 27, 2023, we (Boris Larin, Leonid Bezvershenko, and Georgy Kucherin) delivered a presentation, titled, “Operation Triangulation: What You Get When Attack iPhones of Researchers”, at the 37th Chaos Communication Congress (37C3), held at Congress Center Hamburg. The presentation summarized the results of our long-term research into Operation Triangulation, conducted with our colleagues, Igor Kuznetsov, Valentin Pashkov, and Mikhail Vinogradov. This presentation was also the ...

Apple drops urgent patch against obtuse TriangleDB iPhone malware
The Register

Topics Security Off-Prem On-Prem Software Offbeat Special Features Vendor Voice Vendor Voice Resources Kaspersky first found this software nasty on its own phones

Apple pushed several security fixes on Wednesday, including one for all iPhone and iPads used before September last year that has already been exploited by cyber snoops. The vulnerability, tracked as CVE-2023-32434, "may have been actively exploited against versions of iOS released before iOS 15.7," according to Apple's security update. Exploiting this flaw allows the execution of arbitrary code with kernel privileges. This is the second patch that Apple has issued to fix the vulnerability. ...

Apple squashes kernel bug used by TriangleDB spyware
The Register

Topics Security Off-Prem On-Prem Software Offbeat Special Features Vendor Voice Vendor Voice Resources Snoops may be targeting macOS in addition to iPhones, Kaspersky says

Whoever is infecting people's iPhones with the TriangleDB spyware may be targeting macOS computers with similar malware, according to Kaspersky researchers. In the security shop's ongoing analysis of the smartphone snooping campaign – during which attackers exploit a kernel vulnerability to obtain root privileges and install TriangleDB on victims' handsets – Kaspersky analysts uncovered 24 commands provided by the malware that can be used for a range of illicit activities; everything from st...