CVE-2023-40403

What it actually does

A memory handling flaw in web content processing allows disclosure of sensitive information across the network without authentication when a user interacts with malicious content.

Why it matters to the business

Attackers could obtain confidential data from users who visit compromised or attacker-controlled websites, leading to potential data breaches and loss of sensitive information on affected Apple devices.

How an attack unfolds

An attacker hosts or compromises a website containing specially crafted web content that triggers the memory handling issue during rendering; when a user visits the page the flaw leaks sensitive memory contents back to the attacker.

How to fix it

Update affected devices to the fixed releases listed in the advisory: macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, or macOS Sonoma 14.

How to confirm the fix worked

Verify installed OS versions against the fixed releases; confirm the vulnerability is no longer present by checking system update history or running vendor-supplied diagnostics.

Typical attack path

1. Prepare malicious web content exploiting the memory flaw
2. Host or inject the content on a reachable website
3. Trick or wait for a user to visit the page with a vulnerable browser
4. Trigger disclosure of sensitive information during content processing

How to detect it

Review browser or system logs for unexpected memory access or web content processing errors around the time of suspected visits to untrusted sites; correlate with network traffic showing unexpected data exfiltration.

What your security team should do

• Apply the listed OS updates immediately on all managed devices
• Prioritize devices that browse the web frequently
• Monitor for any post-update issues and test critical applications