⚠ Actively exploited
Added to CISA KEV on 2022-02-11. Federal agencies required to patch by 2022-02-25. Required action: Apply updates per vendor instructions..

CVE-2022-22620 — Use After Free in Apple Macos

CWE-416 — Use After Free15 documents11 sources
Severity
8.8HIGHNVD
EPSS
4.0%
top 11.52%
CISA KEV
KEV
Added 2022-02-11
Due 2022-02-25
Exploit
Exploited in wild
Active exploitation observed
Affected products
4
Apple MacosApple SafariApple Ipados+1 more
Timeline
KEV addedFeb 11
KEV dueFeb 25
PublishedMar 18
Latest updateMay 29
CISA Required Action: Apply updates per vendor instructions.

Description

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 (v. 16612.4.9.1.8 and 15612.4.9.1.8). Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages6 packages

▶CVEListV5apple/macosunspecified — 12.2+1
▶NVDapple/macos12.0.0 — 12.2.1
▶CVEListV5apple/safariunspecified — 15.3
▶NVDapple/ipados< 15.3.1
▶NVDapple/safari< 15.3

🔴Vulnerability Details

7
Project0
2022 0-day In-the-Wild Exploitation…so far - Project Zero↗2022-06-01
▶
Project0
An Autopsy on a Zombie In-the-Wild 0-day - Project Zero↗2022-06-01
▶
GHSA
GHSA-2886-x646-53fj: A use after free issue was addressed with improved memory management↗2022-03-19
▶
OSV
CVE-2022-22620: A use after free issue was addressed with improved memory management↗2022-03-18
▶
CVEList
CVE-2022-22620: A use after free issue was addressed with improved memory management↗2022-03-18
▶

📋Vendor Advisories

6
Red Hat
webkitgtk: maliciously crafted web content may lead to arbitrary code execution due to use after free↗2022-02-17
▶
CISA
Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability↗2022-02-11
▶
Apple
CVE-2022-22620: Safari 15.3↗2022-02-10
▶
Apple
CVE-2022-22620: macOS Monterey 12.2.1↗2022-02-10
▶
Apple
CVE-2022-22620: iOS 15.3.1 and iPadOS 15.3.1↗2022-02-10
▶

📄Research Papers

1
arXiv
S2malloc: Statistically Secure Allocator for Use-After-Free Protection And More↗2024-05-29
▶
CVE-2022-22620 — Use After Free in Apple Macos | cvebase