CVE-2022-46689: high-severity vulnerability in Apple tvOS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It exploitation observed in the wild and has a working public exploit.
A race condition in Apple's operating systems allows an app to execute code with kernel-level privileges, potentially giving it complete control over the device. This is a serious vulnerability because kernel privileges grant the deepest access possible to a system.
A race condition (CWE-362) in iOS, macOS, tvOS, watchOS, and iPadOS allows a local app to achieve arbitrary code execution with kernel privileges through a time-of-check to time-of-use (TOCTOU) vulnerability. Exploitation requires the attacker to run code on the target device; successful exploitation results in complete system compromise.
In the same product, most dangerous first.