CVE-2022-22587

What it actually does

This is a memory corruption vulnerability caused by insufficient input validation in a privileged operating-system component. A malicious application or attacker-controlled code path can supply crafted input that corrupts kernel memory and can lead to arbitrary code execution with kernel privileges. Kernel-level execution allows an attacker to bypass process isolation and sandbox boundaries, read or modify protected memory, tamper with security controls, and potentially crash the system. Although the provided CVSS vector indicates network-reachable characteristics, the vendor description specifically describes exploitation by a malicious application, so practical exploitation is best understood as privilege escalation after code execution in a lower-privileged context.

Why it matters to the business

Successful exploitation can result in full compromise of an affected device or server, including theft of sensitive data, installation of spyware or other malware, tampering with security controls, and operational disruption. Because this vulnerability is listed in CISA KEV and was reported as actively exploited in the wild, the risk is driven by confirmed attacker use rather than score alone; the CISA remediation due date of 2022-02-11 has long passed, so any remaining exposure should be treated as urgent technical debt.

How an attack unfolds

An attacker first gets code running in a less-privileged context, most commonly by convincing a user to install or run a malicious application, chaining this bug after another initial-access exploit, or using an already-compromised account or process. The malicious code sends crafted input to the vulnerable kernel-facing interface. Because input validation is insufficient, the kernel mishandles memory, allowing corruption of kernel memory structures. With a successful exploit, the attacker executes code with kernel privileges, escapes normal application sandboxing, disables or bypasses security controls, accesses protected data, and may install persistence or additional payloads. Public reporting indicates active in-the-wild exploitation, so defenders should assume mature exploit chains may hide the crash or cleanup artifacts after privilege escalation.

How to fix it

Upgrade affected Apple platforms to fixed or later releases: iOS 15.3 or later, iPadOS 15.3 or later, macOS Big Sur 11.6.3 or later, and macOS Monterey 12.2 or later. For Debian 11 systems carrying the affected Linux package mapping, update to linux version 5.10.162-1 or later. Where immediate patching is not possible, restrict installation and execution of untrusted applications, enforce application allowlisting, remove local administrator rights where feasible, strengthen EDR/MDM monitoring, block unknown configuration profiles, and prioritize isolation of high-risk systems until patched. Reboot after kernel or OS updates so the fixed kernel is actually loaded.

How to confirm the fix worked

Confirm remediation by checking the running OS and kernel versions, not only the installed package state. Apple devices should report iOS/iPadOS 15.3 or later, macOS Big Sur 11.6.3 or later, or macOS Monterey 12.2 or later. Debian 11 systems should show the relevant linux package at 5.10.162-1 or later and should be rebooted into that kernel. Validate with MDM, vulnerability scanners, package managers, and endpoint inventory. Review scan results for stale kernel findings after reboot, and verify that no unmanaged or unsupported devices remain below the fixed versions.

Typical attack path

1. Identify an affected device or system running a vulnerable OS or kernel version.
2. Obtain initial code execution, commonly through a malicious application, exploit chain, compromised user context, or another local execution path.
3. Invoke the vulnerable kernel-facing interface with malformed or specially crafted input.
4. Trigger memory corruption in the kernel due to inadequate input validation.
5. Gain arbitrary code execution with kernel privileges or root-equivalent control.
6. Disable or evade security controls, access protected data, and establish persistence or deploy follow-on payloads.
7. Clean up artifacts or blend activity into normal system behavior to reduce detection.

How to detect it

Look for evidence consistent with local privilege escalation or kernel-level exploitation. Relevant sources include endpoint detection telemetry, kernel/system logs, crash and panic reports, mobile device management logs, application installation history, process execution logs, file integrity monitoring, and authentication/session logs. Investigate unexplained kernel panics or crashes shortly before new privileged processes, unsigned or unexpected applications, changes to security tooling, persistence creation, suspicious child processes from user-installed apps, or anomalous access to protected files. On Apple platforms, review panic logs, Analytics/Diagnostic logs, Unified Logs, MDM compliance events, and unexpected app profiles or entitlements. On Debian/Linux systems, review syslog, kern.log, dmesg, auditd, EDR events, package version history, and signs of privilege escalation from unprivileged users to root. There are no widely reliable public exploit-specific IOCs for this issue; detection should focus on exploitation behaviors and post-exploitation activity rather than a single signature.

• panic(cpu
• Kernel panic
• BUG: unable to handle kernel
• general protection fault
• Oops:
• kernel NULL pointer dereference
• segfault at
• audit: USER_AVC
• sudo: pam_unix(sudo:session): session opened for user root
• /var/log/kern.log
• /var/log/syslog
• /var/log/audit/audit.log
• /Library/Logs/DiagnosticReports/
• /Library/Logs/CrashReporter/

What your security team should do

• Immediately inventory affected iOS, iPadOS, macOS, and Debian 11/Linux assets and identify systems below the fixed versions.
• Prioritize patching because this is a KEV-listed vulnerability with reported active exploitation and an overdue federal remediation deadline.
• Update Apple devices to iOS/iPadOS 15.3 or later, macOS Big Sur 11.6.3 or later, or macOS Monterey 12.2 or later; update Debian 11 Linux packages to 5.10.162-1 or later where applicable.
• Confirm devices have rebooted after patching and are running the fixed kernel or OS build, not merely staged updates.
• Hunt for prior exploitation using kernel crash logs, endpoint telemetry, suspicious privilege escalation, unexpected root-level activity, and signs of disabled security tooling.
• Restrict execution of untrusted applications and enforce MDM or application-control policies, especially on high-value user endpoints.
• Escalate any suspicious kernel crash followed by privilege changes, persistence creation, or security-control tampering for forensic review.