CVE-2022-26765 — Race Condition in Apple Watchos

CWE-362 — Race Condition6 documents3 sources
Severity
4.7MEDIUMNVD
EPSS
0.1%
top 81.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Apple WatchosApple IpadosApple Iphone OS+4 more
Timeline
PublishedMay 26
Latest updateMay 27

Description

A race condition was addressed with improved state handling. This issue is fixed in watchOS 8.6, tvOS 15.5, macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5. A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 1.0 | Impact: 3.6

Affected Packages10 packages

▶NVDapple/tvos< 15.5
▶NVDapple/macos12.0 — 12.4
▶NVDapple/ipados< 15.5
▶CVEListV5apple/watchosunspecified — 8.6+2

🔴Vulnerability Details

1
GHSA
GHSA-88mg-jr8r-pqgg: A race condition was addressed with improved state handling↗2022-05-27
▶

📋Vendor Advisories

4
Apple
CVE-2022-26765: macOS Monterey 12.4↗2022-05-16
▶
Apple
CVE-2022-26765: tvOS 15.5↗2022-05-16
▶
Apple
CVE-2022-26765: watchOS 8.6↗2022-05-16
▶
Apple
CVE-2022-26765: iOS 15.5 and iPadOS 15.5↗2022-05-16
▶