CVE-2023-23520 — Time-of-check Time-of-use (TOCTOU) Race Condition in Apple IOS AND Ipados

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition6 documents3 sources
Severity
5.9MEDIUMNVD
EPSS
0.2%
top 64.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Apple IOS AND IpadosApple MacosApple Tvos+5 more
Timeline
PublishedFeb 27

Description

A race condition was addressed with additional validation. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. A user may be able to read arbitrary files as root.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages11 packages

▶CVEListV5apple/tvosunspecified — 16.3
▶CVEListV5apple/macosunspecified — 13.2
▶NVDapple/macos< 13.2
▶NVDapple/ipados< 16.3

🔴Vulnerability Details

1
GHSA
GHSA-p22w-hm7x-wwfc: A race condition was addressed with additional validation↗2023-02-27
▶

📋Vendor Advisories

4
Apple
CVE-2023-23520: tvOS 16.3↗2023-01-24
▶
Apple
CVE-2023-23520: watchOS 9.3↗2023-01-23
▶
Apple
CVE-2023-23520: iOS 16.3 and iPadOS 16.3↗2023-01-23
▶
Apple
CVE-2023-23520: macOS Ventura 13.2↗2023-01-23
▶