CVE-2022-42848 — Protection Mechanism Failure in Apple Tvos

CWE-693 — Protection Mechanism Failure6 documents4 sources
Severity
7.8HIGHNVD
EPSS
0.3%
top 48.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Apple TvosApple IpadosApple Iphone OS+3 more
Timeline
PublishedDec 15

Description

A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2, tvOS 16.2. An app may be able to execute arbitrary code with kernel privileges.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages7 packages

▶NVDapple/ipados16.0 — 16.2+1
▶CVEListV5apple/tvosunspecified — 16.2+1
▶NVDapple/tvos< 16.2

🔴Vulnerability Details

2
GHSA
GHSA-mv7w-74c6-4w37: A logic issue was addressed with improved checks↗2022-12-15
▶
VulnCheck
iOS and iPadOS, and tvOS Kernel Privilege App Code Execution Vulnerability↗2022
▶

📋Vendor Advisories

3
Apple
CVE-2022-42848: iOS 16.2 and iPadOS 16.2↗2022-12-13
▶
Apple
CVE-2022-42848: iOS 15.7.2 and iPadOS 15.7.2↗2022-12-13
▶
Apple
CVE-2022-42848: tvOS16.2↗2022-12-13
▶