CVE-2023-38606: medium-severity vulnerability in Apple macOS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A flaw in Apple's kernel state management could allow an app running on your device to modify sensitive system-level settings without proper authorization. This vulnerability has been actively exploited in real-world attacks.
This kernel state management vulnerability allows a local app to modify sensitive kernel state through improper state handling. Exploitation requires a malicious app installed on the device; the issue affects multiple Apple platforms and has been documented in active exploitation campaigns prior to iOS 15.7.1.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.