CVE-2022-42827

What it actually does

This is an out-of-bounds write memory corruption vulnerability in Apple iOS and iPadOS. A crafted application or exploit component can write outside the intended memory bounds and corrupt kernel memory, allowing arbitrary code execution with kernel privileges. Successful exploitation can escape normal application sandbox boundaries and give the attacker control over highly privileged operating system functions.

Why it matters to the business

Compromised iPhones or iPads can allow attackers to access sensitive data, bypass device security controls, install persistent surveillance tooling, or disrupt normal device operation. Because Apple reported active exploitation and the issue is listed in CISA KEV with a remediation due date of 2022-11-15, unpatched devices should be treated as high-priority exposure even though exploitation requires local execution or user interaction.

How an attack unfolds

An attacker first gets exploit code to run on the target device, commonly by convincing the user to install or open a malicious application or by using this flaw as part of a larger exploit chain. The exploit triggers the out-of-bounds write condition to corrupt kernel memory in a controlled way. If successful, the attacker gains code execution with kernel privileges, which can be used to bypass sandboxing, disable or evade security protections, access protected data, and support installation of follow-on payloads. Apple has stated that the issue may have been actively exploited in the wild, so exploitation should be considered realistic for exposed, unpatched devices.

How to fix it

Upgrade affected Apple devices to fixed versions immediately: iOS 15.7.1 or later, iPadOS 15.7.1 or later, iOS 16.1 or later, and iPadOS 16 or later. Where possible, move devices to the latest supported iOS or iPadOS release rather than only the minimum fixed version. Enforce mobile device management policies that block outdated OS versions, restrict installation of untrusted applications, and require rapid security update adoption. The supplied package metadata also lists nodejs/node fixed in commit 79c57d0cc55db834177d2f8ce4b4d83109a23dc9; validate applicability before taking package-specific action because the vulnerability description and vendor fix information are for Apple iOS and iPadOS.

How to confirm the fix worked

Confirm that all in-scope Apple devices report iOS 15.7.1, iPadOS 15.7.1, iOS 16.1, iPadOS 16, or a later supported release. Validate through MDM inventory, device compliance reports, Apple security update status, or direct device settings checks. Confirm no managed device remains on vulnerable builds and that compliance policies quarantine, block access from, or prompt updates for noncompliant devices. For software inventories that include the supplied Git package metadata, verify whether nodejs/node is actually in scope and, if so, confirm the repository includes commit 79c57d0cc55db834177d2f8ce4b4d83109a23dc9 or a later trusted revision.

Typical attack path

1. Identify a target using a vulnerable iOS or iPadOS version.
2. Deliver a malicious application, exploit component, or exploit chain requiring user interaction.
3. Trigger the out-of-bounds write condition in kernel-accessible code.
4. Corrupt kernel memory to gain arbitrary code execution with kernel privileges.
5. Bypass sandbox and operating system protections.
6. Access protected data, establish surveillance capability, or deploy additional payloads.

How to detect it

Look for evidence of exploitation on devices that were running vulnerable iOS or iPadOS versions before patching. Useful sources include MDM inventory and compliance history, Apple unified logs if available, sysdiagnose captures, crash and panic logs, application installation history, VPN/proxy/DNS telemetry, EDR or mobile threat defense alerts, and forensic mobile acquisition results. Focus on unexpected kernel panics or repeated crashes around suspicious app activity, newly installed or sideloaded applications, unusual permission usage, configuration profile changes, unexplained network connections from mobile devices, and signs of jailbreak-like behavior on devices that should be managed and locked down. Because public, CVE-specific indicators are limited, absence of a known IOC should not be treated as proof of non-exploitation; prioritize behavioral review and forensic analysis for high-risk unpatched devices.

What your security team should do

• Prioritize remediation of all vulnerable iOS and iPadOS devices because this vulnerability is known to have been exploited in the wild and is listed in CISA KEV.
• Use MDM to identify devices below iOS 15.7.1, iPadOS 15.7.1, iOS 16.1, or iPadOS 16 and force upgrade or restrict access until remediated.
• Review high-risk users and devices for signs of targeted mobile compromise, especially where devices were unpatched after public disclosure.
• Restrict installation of unmanaged or untrusted applications and ensure app installation sources are tightly controlled.
• Collect and preserve relevant mobile device logs before wiping or reimaging suspected compromised devices.
• If compromise is suspected, perform full mobile forensic triage rather than relying only on device patch status.
• Validate the apparent nodejs/node fixed-version metadata before acting on it, as the vulnerability details indicate Apple iOS and iPadOS impact.