CVE-2022-32894

What it actually does

This is an out-of-bounds write memory corruption vulnerability that can allow an application to corrupt kernel memory and execute arbitrary code with kernel privileges. Successful exploitation breaks the normal user/kernel security boundary, enabling a malicious process to escape application sandboxing, disable or bypass security controls, access protected data, and potentially maintain control over the device. The vulnerability is known to have been exploited in the wild and is listed in CISA KEV.

Why it matters to the business

Compromise of affected Apple endpoints can lead to theft of corporate data, credential exposure, surveillance of users, loss of device integrity, and broader compromise if the device is used to access business systems. Because exploitation was reported in the wild and the CISA KEV remediation deadline of 2022-09-08 has long passed, any remaining exposure should be treated as overdue high-priority remediation even though the EPSS score is relatively low.

How an attack unfolds

An attacker first needs code execution in the context of an application or must convince a user to run or interact with attacker-controlled content that causes a vulnerable app path to execute. In real-world campaigns, vulnerabilities like this are commonly chained with an initial browser, document, messaging, or application exploit to get code running without obvious user awareness. The malicious code then triggers the out-of-bounds write in the kernel, carefully corrupting memory structures to redirect execution flow or modify security-relevant kernel state. Once kernel privileges are obtained, the attacker can bypass sandbox restrictions, access sensitive files and credentials, tamper with security tooling, install additional payloads, and conceal activity. Apple reported active exploitation, so post-exploitation review should focus on evidence of suspicious app execution, unexpected device crashes, abnormal kernel panics, and signs of follow-on persistence or data access.

How to fix it

Upgrade affected Apple systems to fixed or later versions: iOS 15.6.1 or later, iPadOS 15.6.1 or later, and macOS Monterey 12.5.1 or later. Prefer upgrading to the latest supported iOS, iPadOS, or macOS release rather than only the minimum fixed version, because later releases include additional security fixes. Use MDM or endpoint management to enforce minimum OS versions, block access from non-compliant devices, and remove unsupported devices from sensitive workflows. If software inventory maps this issue to nodejs/node GIT, verify that any tracked source build includes commit fa9990f3fb5b06fe94e294925246d2c136deb2c2 or a later fixed revision, but prioritize the Apple OS updates described in the vendor advisory. Where immediate patching is not possible, restrict untrusted application installation, limit exposure to untrusted links and attachments, enforce device compliance checks, and increase monitoring for suspicious crashes and post-exploitation behavior.

How to confirm the fix worked

Confirm the device OS version is at or above iOS 15.6.1, iPadOS 15.6.1, or macOS Monterey 12.5.1, or that the device is running a newer supported major version. Validate through MDM inventory, endpoint management reports, local OS version checks, and vulnerability scanner results. For macOS, verify security update installation history and current build numbers; for iOS and iPadOS, verify managed device compliance state and minimum OS enforcement. If a source dependency inventory references nodejs/node GIT, confirm the repository or vendored source contains commit fa9990f3fb5b06fe94e294925246d2c136deb2c2 or a later commit. After remediation, rescan assets, review exception lists, and ensure legacy or unmanaged devices are not still permitted to access sensitive services.

Typical attack path

1. Identify a target using a vulnerable iOS, iPadOS, or macOS version.
2. Deliver malicious content or a malicious application, often as part of a chain with another initial code-execution vulnerability.
3. Induce the user or application to process the attacker-controlled input or run the malicious code.
4. Trigger the out-of-bounds write condition in kernel-accessible code.
5. Corrupt kernel memory to gain arbitrary code execution with kernel privileges.
6. Escape sandbox restrictions and disable or bypass endpoint protections where possible.
7. Access protected data, credentials, messages, files, or enterprise application sessions.
8. Deploy additional tooling, maintain access, or exfiltrate data before cleanup.

How to detect it

There are no universally reliable public indicators for exploitation of this kernel memory corruption issue, so detection should combine exposure review, endpoint telemetry, crash analysis, and behavioral hunting. Review MDM and endpoint inventory for devices that were vulnerable during the exposure window and prioritize those with suspicious activity before patching. On macOS, inspect Unified Logs, crash reports, panic logs, Endpoint Security telemetry, EDR alerts, application execution history, login items, launch agents, launch daemons, configuration profile changes, and unusual TCC/privacy permission changes. On iOS and iPadOS, use MDM security telemetry, device analytics, crash diagnostics, application inventory changes, configuration profile history, and network telemetry from secure web gateways or DNS resolvers. Look for unexplained kernel panics, repeated crashes in apps that processed messages, web content, documents, or attachments, unexpected installation of profiles or apps, sudden security control failures, and anomalous outbound connections shortly after a crash or suspicious user interaction. Because exploitation may be chained with another initial-access flaw, also hunt around suspicious links, messages, attachments, browser events, and app launches preceding any kernel crash or device instability. For high-risk suspected devices, collect full forensic images or vendor-supported sysdiagnose artifacts where possible and consider reimaging or replacing the device if kernel compromise cannot be ruled out.

What your security team should do

• Treat any remaining vulnerable Apple devices as urgent because the vulnerability is in CISA KEV, has reported in-the-wild exploitation, and the federal remediation deadline has passed.
• Enforce OS upgrades through MDM or endpoint management to iOS 15.6.1, iPadOS 15.6.1, macOS Monterey 12.5.1, or newer supported releases.
• Identify and isolate devices that cannot be upgraded, especially those used by executives, administrators, developers, legal teams, finance teams, or other high-value users.
• Hunt for suspicious device crashes, kernel panics, unexpected application terminations, unsigned or unusual applications, profile changes, and abnormal access to sensitive data around the period before patching.
• Review recent mobile and macOS threat intelligence for exploit chains involving Apple kernel privilege escalation vulnerabilities, including possible pairing with browser or messaging exploits.
• Require device compliance before granting access to enterprise email, identity providers, VPN, management consoles, source repositories, and other sensitive applications.
• If inventory tooling reports nodejs/node GIT exposure for this CVE, validate the mapping and ensure builds include commit fa9990f3fb5b06fe94e294925246d2c136deb2c2 or later.
• Preserve forensic evidence from high-risk or suspicious devices before wiping, because kernel-level exploitation may leave limited conventional artifacts.