CVE-2023-38606

What it actually does

This is a local privilege-escalation flaw in Apple operating system kernel state management. A malicious app running on an affected device may be able to modify sensitive kernel state, undermining kernel integrity controls and potentially gaining elevated privileges or capabilities beyond the app sandbox. The CVSS vector indicates local exploitation with low attack complexity, no privileges required, and user interaction required, with primary impact to integrity rather than confidentiality or availability.

Why it matters to the business

Successful exploitation can turn a seemingly ordinary malicious app or exploit chain component into a deeper device compromise, allowing attackers to tamper with operating system protections and maintain stronger control over affected Apple devices. Because Apple reported active exploitation against iOS versions prior to 15.7.1 and the issue is listed in CISA KEV with a remediation due date of 2023-08-16, unpatched legacy iPhones, iPads, Macs, Apple TVs, and Apple Watches should be treated as higher-risk assets, especially where they are used for executive, administrative, development, or other sensitive business functions.

How an attack unfolds

An attacker first needs code execution on the target device, typically by convincing a user to install or run a malicious app, abusing an enterprise-signed or sideloaded app path, or combining this flaw with another vulnerability that delivers code execution. Once the attacker-controlled code runs locally, it triggers the vulnerable Apple kernel state-management condition to modify sensitive kernel state. That kernel-level tampering can allow the attacker to bypass normal app isolation, alter protected execution state, or support later-stage actions such as persistence, surveillance, credential access, or installation of additional payloads. Apple has stated that the issue may have been actively exploited against iOS versions released before iOS 15.7.1; reported threat context includes Coruna and references to Apple multiple-product kernel exploitation, so investigations should consider this vulnerability as a possible privilege-escalation stage within a broader mobile or endpoint compromise chain rather than as a standalone remote attack.

How to fix it

Upgrade all affected Apple platforms to fixed or later releases. Apple lists fixes in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, and watchOS 9.6. Where devices cannot be upgraded, reduce exposure by removing untrusted or unnecessary apps, disabling sideloading and unapproved developer/enterprise profiles, enforcing mobile device management compliance policies, limiting access to sensitive business services from noncompliant devices, and isolating or retiring unsupported hardware. Because this vulnerability is in CISA KEV and has known in-the-wild exploitation, mitigation should not be treated as equivalent to patching except as a temporary containment measure.

How to confirm the fix worked

Confirm device OS versions through MDM inventory, endpoint management, or local system checks and verify they are at or above the Apple fixed releases: iOS/iPadOS 15.7.8 or 16.6, macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5, tvOS 16.6, and watchOS 9.6. Validate that vulnerable versions, especially iOS releases before 15.7.1, no longer have access to sensitive services. Review MDM compliance results for devices failing minimum-version policy, devices without recent check-in, devices with unmanaged status, or devices with unapproved configuration profiles. For macOS, supplement inventory validation with local checks such as `sw_vers` and software update history; for mobile and watch/tv platforms, rely on MDM-reported OS version and update status.

Typical attack path

1. Identify an affected Apple device running a vulnerable iOS, iPadOS, macOS, tvOS, or watchOS version.
2. Deliver or cause execution of attacker-controlled local code, commonly through a malicious app, sideloaded profile, exploit chain, or another initial-code-execution vulnerability.
3. Invoke the kernel state-management flaw from local code.
4. Modify sensitive kernel state to weaken sandboxing or other operating system protections.
5. Use the elevated capability to perform follow-on actions such as tampering with security controls, accessing protected resources, deploying additional payloads, or maintaining persistence.

How to detect it

There are no broadly reliable public, vulnerability-specific indicators that prove exploitation of this kernel issue. Detection should focus on signs of a broader Apple device compromise chain: vulnerable OS versions present after the patch deadline, suspicious app installation or execution shortly before anomalous behavior, unknown enterprise developer certificates, unexpected configuration profiles, jailbreak-like artifacts, unexplained MDM enrollment changes, security controls being disabled, repeated kernel panics, or device telemetry showing unusual persistence or surveillance behavior. Useful log and telemetry sources include MDM inventory and compliance history, app inventory, enterprise certificate/profile records, EDR telemetry on macOS, Unified Logs on macOS, crash and panic logs, network security telemetry, DNS/proxy logs for suspicious command-and-control traffic, and mobile threat defense telemetry where available. For iOS/iPadOS, collect sysdiagnose, analytics, crash, and profile/app inventory data when feasible; for macOS, review Unified Logs, EndpointSecurity/EDR events, launch agents/daemons, privileged helper tools, kernel/panic logs, and recent software installation records. Because exploitation was reported against older iOS releases and linked threat context includes Coruna, prioritize historical review of high-value devices that ran pre-15.7.1 iOS and showed suspicious app/profile activity or anomalous network behavior before remediation.

What your security team should do

• Immediately prioritize remediation for all affected Apple devices because the vulnerability is KEV-listed and exploitation has been reported in the wild.
• Hunt first for high-value or high-risk devices running iOS versions before 15.7.1, then expand to all affected iOS, iPadOS, macOS, tvOS, and watchOS versions below the fixed releases.
• Enforce MDM minimum OS version policies matching or exceeding Apple’s fixed versions and block access to sensitive services from noncompliant devices.
• Remove untrusted apps, unknown enterprise-signed apps, sideloading paths, and suspicious configuration profiles from affected devices pending patch validation.
• Investigate any device with suspicious app installation, unexpected MDM/profile changes, jailbreak-like artifacts, repeated kernel panics, or unexplained security-control tampering around the exploitation window.
• If compromise is suspected on mobile devices, prefer full forensic acquisition with appropriate tooling or device replacement/re-enrollment rather than relying only on app removal.
• Document exceptions for devices that cannot be upgraded and apply compensating controls, including network/service restrictions and accelerated replacement.