In CISA KEVNot scored
CVE-2023-41974
Apple iOS and iPadOS Use-After-Free Vulnerability
AppleiOS and iPadOS
Status
- Exploited in the wild
- In CISA KEV since 5 Mar
- Vendor fix available
Federal deadlineThu 26 Mar, 23:59 UTC
Passed 212 days ago
CISA KEV · added 5 Mar
Exploit probabilityEPSSchecked 25 Oct
2.0%probability of exploitation in the next 30 days
Higher than 80% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, iOS 15.8.7 and iPadOS 15.8.7. An app may be able to execute arbitrary code with kernel privileges.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 7 articles · 5 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 5 Mar · 21:25 UTC | CISA | CVE-2023-41974: Attackers can run kernel code on iOS and iPadOS |
| Thu 5 Mar · 21:44 UTC | CISA | CISA flags Apple iOS kernel exploit CVE-2023-41974 in KEV list |
| Fri 6 Mar · 09:57 UTC | Security Affairs | CISA Adds CVEs to KEV for Apple Rockwell and Hikvision Flaws |
| Thu 12 Mar · 11:08 UTC | The Hacker News | Apple Issues Security Updates for Older iOS Devices Targeted by Coruna WebKit Exploit |
| Thu 12 Mar · 15:11 UTC | SecurityWeek | Apple Updates Older iOS Versions to Patch Coruna Exploits |
| Thu 12 Mar · 15:41 UTC | Security Affairs | Apple issues emergency fixes for Coruna flaws in older iOS versions |
| Thu 12 Mar · 18:16 UTC | Malwarebytes | Apple patches Coruna exploit kit flaws for older iOS versions |
- Apple patches Coruna exploit kit flaws for older iOS versionsMalwarebytes · mentions it in passing
- Apple issues emergency fixes for Coruna flaws in older iOS versionsSecurity Affairs
- Apple Updates Older iOS Versions to Patch Coruna ExploitsSecurityWeek
- Apple Issues Security Updates for Older iOS Devices Targeted by Coruna WebKit ExploitThe Hacker News · mentions it in passing
- CISA Adds CVEs to KEV for Apple Rockwell and Hikvision FlawsSecurity Affairs · mentions it in passing
- CISA flags Apple iOS kernel exploit CVE-2023-41974 in KEV listCISA · official notice
- CVE-2023-41974: Attackers can run kernel code on iOS and iPadOSCISA · first in our coverage · official notice