CVE-2022-22674

What it actually does

CVE-2022-22674 is a local out-of-bounds read vulnerability in Apple macOS that can allow a low-privileged local user or locally executing malicious code to read kernel memory. The flaw is a memory disclosure issue caused by insufficient input validation. By exposing kernel memory contents, it can leak sensitive data such as kernel pointers or structures and may help bypass exploit mitigations such as kernel address randomization when chained with a separate privilege-escalation or code-execution vulnerability. The issue affects Apple macOS / Mac OS X and is fixed in macOS Monterey 12.3.1, macOS Big Sur 11.6.6, and Security Update 2022-004 for Catalina.

Why it matters to the business

Successful exploitation can expose sensitive information from the operating system kernel and may make broader compromise easier if paired with another local vulnerability or malware already running on the device. Because this vulnerability is listed in CISA KEV and has documented in-the-wild exploitation, unpatched macOS systems should be treated as higher priority even though the flaw requires local access and is not directly exploitable over the network. The CISA remediation due date of 2022-04-25 has long passed, so remaining exposure indicates a materially overdue patching gap for managed macOS fleets.

How an attack unfolds

An attacker first needs code execution or an account on the target macOS system, such as through malware, a malicious application, stolen local credentials, or another initial-access technique. The attacker then invokes the vulnerable kernel-facing interface with crafted input that causes the operating system to read beyond the intended memory boundary. Instead of directly granting control of the system, the bug discloses kernel memory contents to the attacker. That information can reveal addresses, object layouts, or other sensitive kernel data that are useful for defeating exploitation defenses. In practical attacks, this type of bug is commonly used as part of a chain: the memory disclosure prepares the environment for a separate local privilege-escalation exploit, persistence mechanism, or credential/access theft activity. Public reporting and KEV inclusion indicate active exploitation in the wild, so defenders should assume this weakness may have been used opportunistically against unpatched macOS endpoints.

How to fix it

Upgrade affected macOS systems to a fixed or later Apple release. Specifically, apply macOS Monterey 12.3.1 or later, macOS Big Sur 11.6.6 or later, or Security Update 2022-004 for Catalina where Catalina remains in scope. Systems older than supported Apple patch levels should be upgraded to a supported macOS version. If immediate patching is not possible, reduce local exploitation opportunities by restricting untrusted software execution, enforcing application allow-listing or notarization controls, limiting local administrative privileges, removing unnecessary local accounts, and using endpoint protection capable of detecting suspicious local exploit behavior. Mitigations should be considered temporary because the reliable fix is Apple’s security update.

How to confirm the fix worked

Confirm remediation by checking the installed macOS version and security update level against Apple’s fixed releases: Monterey must be 12.3.1 or later, Big Sur must be 11.6.6 or later, and Catalina must have Security Update 2022-004 or later applied. On individual systems, verify with commands such as `sw_vers` and Apple software update inventory tooling. In fleet management systems, query OS build/version compliance and identify devices below the fixed versions. Also verify that automatic update policies, MDM compliance rules, and endpoint inventory data agree; stale inventory can hide unpatched endpoints. Exposure remains if a device runs an affected macOS release without the corresponding Apple security update.

Typical attack path

1. Gain local access to a vulnerable macOS system through malware execution, a malicious application, an existing user account, or another initial compromise method.
2. Run exploit code under a local user context.
3. Send crafted input to the vulnerable macOS kernel component/interface that lacks sufficient bounds validation.
4. Trigger an out-of-bounds read and recover kernel memory contents.
5. Use leaked kernel information to bypass memory protections or support a second-stage local privilege-escalation exploit.
6. Continue post-exploitation activity such as privilege escalation, persistence, credential access, data collection, or lateral movement, depending on the attacker’s objectives.

How to detect it

There is no universal, reliable log entry that proves exploitation of this kernel memory disclosure vulnerability, and successful exploitation may leave few direct artifacts. Detection should focus on endpoint telemetry and correlated suspicious behavior on macOS systems that were vulnerable at the time. Review EDR, unified logs, crash reports, and process execution history for unknown or unsigned binaries running shortly before privilege changes, kernel panics, abnormal process crashes, or suspicious access to low-level system interfaces. Investigate sequences where a user-level process is followed by privilege escalation, new launch agents or daemons, modified persistence locations, credential access attempts, or execution of additional payloads. Useful log and artifact sources include Apple Unified Logging, EndpointSecurity/EDR telemetry, `/Library/Logs/DiagnosticReports/`, `/Library/Logs/CrashReporter/`, `/var/log/install.log`, MDM/software update compliance records, launch daemon and launch agent directories, shell histories where available, and quarantine/notarization events. Because KEV confirms exploitation in the wild, prioritize retrospective hunting on systems that remained below macOS Monterey 12.3.1, Big Sur 11.6.6, or Catalina Security Update 2022-004 after the public fix became available. Absence of crash logs or obvious exploit strings should not be considered proof that exploitation did not occur.

What your security team should do

• Prioritize remediation for all macOS systems because the vulnerability is in CISA KEV and has active in-the-wild exploitation history.
• Identify all macOS endpoints running Monterey before 12.3.1, Big Sur before 11.6.6, or Catalina without Security Update 2022-004, and patch or upgrade them.
• Treat any remaining unpatched systems as exception-managed risk with compensating controls, documented ownership, and a time-bound remediation plan.
• Hunt for signs of local exploit chaining on previously vulnerable systems, especially suspicious local privilege escalation, unusual kernel crashes, unexpected new privileged processes, or malware execution around the period before patching.
• Restrict execution of untrusted macOS binaries using MDM, Gatekeeper, notarization enforcement, EDR controls, and least-privilege user configurations.
• Review endpoint protection telemetry for local exploit behavior rather than relying on a single signature, because memory disclosure bugs often leave limited forensic artifacts.
• Ensure macOS patch compliance reporting includes security updates as well as major/minor OS version numbers.