CVE-2022-22675

What it actually does

CVE-2022-22675 is a local memory corruption vulnerability in Apple operating systems caused by an out-of-bounds write that was corrected with improved bounds checking. Successful exploitation allows an application to execute arbitrary code with kernel privileges. Because kernel-level execution gives control over core operating system functions, exploitation can enable sandbox escape, privilege escalation, security control bypass, tampering with protected files or processes, credential access, persistence, and full device compromise. The CVSS vector indicates local attack access with low complexity, no privileges required, and user interaction required, with high confidentiality, integrity, and availability impact.

Why it matters to the business

A compromised Apple device may be fully controlled by an attacker after a user runs or is induced to interact with a malicious application or exploit chain. This can lead to theft of sensitive data, surveillance, loss of device integrity, disruption of business operations, and bypass of endpoint security controls. The vulnerability is listed in CISA Known Exploited Vulnerabilities and Apple reported possible active exploitation, so unpatched iOS, iPadOS, macOS, tvOS, and watchOS devices should be treated as high-priority exposure even though the issue is older and not specifically associated with ransomware in KEV.

How an attack unfolds

An attacker typically needs local code execution or a delivery path that causes a user to launch or interact with attacker-controlled content, such as a malicious application, malicious attachment, compromised website paired with another vulnerability, or a broader exploit chain. Once attacker-controlled code runs in a vulnerable Apple OS context, the exploit triggers the out-of-bounds write to corrupt kernel memory in a controlled way. The attacker then redirects execution or modifies kernel data structures to gain kernel privileges. With kernel privileges, the attacker can escape application sandboxing, disable or evade security protections, access protected data, install persistence, hide activity, or deploy additional payloads. Apple has stated that this issue may have been actively exploited, and it appears in the CISA KEV catalog with a remediation due date of 2022-04-25, indicating real-world exploitation risk rather than a purely theoretical flaw.

How to fix it

Upgrade affected Apple operating systems to fixed or later releases: iOS 15.4.1 or later, iPadOS 15.4.1 or later, macOS Monterey 12.3.1 or later, macOS Big Sur 11.6.6 or later, watchOS 8.6 or later, and tvOS 15.5 or later. Where devices cannot be upgraded immediately, restrict installation of untrusted applications, enforce managed app allowlisting where available, block sideloading and untrusted developer profiles, apply MDM compliance policies to quarantine or limit access from outdated devices, and increase monitoring for signs of compromise. Because this is a kernel privilege escalation with reported exploitation, mitigation should not be considered equivalent to patching; affected devices should be updated or retired.

How to confirm the fix worked

Confirm OS build versions through Apple device management inventory, endpoint management, or local system checks. On macOS, verify the installed version with system settings or command-line tools such as `sw_vers`, and confirm that Monterey is 12.3.1 or later or Big Sur is 11.6.6 or later. On iOS and iPadOS, confirm version 15.4.1 or later; on watchOS, confirm 8.6 or later; on tvOS, confirm 15.5 or later. Validate that MDM or endpoint compliance reports no remaining devices below the fixed versions. For higher assurance, review patch deployment telemetry, reboot status, and software update logs to ensure updates were successfully installed rather than merely offered or downloaded.

Typical attack path

1. Identify a target using a vulnerable Apple OS version: iOS before 15.4.1, iPadOS before 15.4.1, macOS Monterey before 12.3.1, macOS Big Sur before 11.6.6, watchOS before 8.6, or tvOS before 15.5.
2. Deliver or stage attacker-controlled code through a malicious app, exploit chain, social engineering, or another initial-access vector that results in local execution on the device.
3. Trigger the out-of-bounds write condition to corrupt kernel memory.
4. Manipulate kernel memory or execution flow to obtain arbitrary code execution with kernel privileges.
5. Use kernel privileges to bypass sandboxing and platform protections, access sensitive data, tamper with system state, or install additional payloads.
6. Attempt to maintain stealth by cleaning artifacts, hiding processes, abusing legitimate system components, or relying on ephemeral in-memory execution.

How to detect it

Detection is difficult because exploitation occurs through kernel memory corruption and may leave limited direct artifacts. Security teams should focus on identifying devices that were vulnerable during the exploitation window and correlating suspicious local execution, crashes, privilege changes, and post-exploitation behavior. Review macOS Unified Logs, crash reports, Endpoint Security or EDR telemetry, MDM inventory and compliance history, application installation records, Gatekeeper and notarization events, system extension and launch persistence locations, and network telemetry for unusual outbound connections from suspicious processes. On iOS, iPadOS, watchOS, and tvOS, available telemetry is more limited; use MDM records, analytics/crash logs, app inventory, VPN/proxy/DNS logs, and device compliance timelines. Look for repeated kernel panics or abnormal application crashes shortly before suspicious privilege changes, installation of unknown profiles or apps, unexpected disabling of security tools, creation of unusual LaunchAgents or LaunchDaemons on macOS, or activity from unsigned or recently installed applications. Because no public exploit-specific artifact is reliably associated with this vulnerability, absence of indicators should not be treated as proof of non-exploitation.

• iOS version < 15.4.1
• iPadOS version < 15.4.1
• macOS Monterey version < 12.3.1
• macOS Big Sur version < 11.6.6
• watchOS version < 8.6
• tvOS version < 15.5
• /Library/LaunchAgents/
• /Library/LaunchDaemons/
• ~/Library/LaunchAgents/
• /Library/PrivilegedHelperTools/
• /Library/Extensions/
• /System/Library/Extensions/
• kernel panic
• panic(cpu
• EXC_BAD_ACCESS
• KERN_INVALID_ADDRESS
• Code Signature Invalid
• spctl
• syspolicyd
• taskgated
• amfid
• launchd

What your security team should do

• Prioritize immediate identification and remediation of Apple devices running vulnerable versions, especially unmanaged, internet-facing, executive, developer, or high-privilege user devices.
• Use MDM or endpoint inventory to enforce minimum OS versions: iOS/iPadOS 15.4.1, macOS Monterey 12.3.1, macOS Big Sur 11.6.6, watchOS 8.6, and tvOS 15.5 or later.
• Treat devices that remained vulnerable after the CISA KEV due date of 2022-04-25 as candidates for targeted compromise review, particularly if they are high-value assets.
• Restrict untrusted application installation, unknown developer profiles, sideloading, and unnecessary local execution paths on Apple devices.
• Hunt for signs of suspicious application execution, crash patterns, privilege escalation attempts, unknown kernel or system extensions, unusual persistence mechanisms, and unexpected security-control changes on formerly vulnerable devices.
• For devices with credible indicators of compromise, preserve logs and forensic images where feasible, rotate credentials used from the device, and consider full erase/reprovisioning rather than relying only on patching.