CVE-2022-32832
MEDIUMiPadOS < 15.6 - Authenticated Remote Code Execution
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2022-32832. PoCs published by Muirey03, AkbarTrilaksana.
AI-analyzed exploit summary This repository contains a functional proof-of-concept exploit for CVE-2022-32832, a race condition vulnerability in AppleAPFSUserClient::methodDeltaCreateFinalize. The exploit triggers a double-free by racing two calls to the vulnerable method, leading to a kernel panic on vulnerable macOS versions.
Description
The issue was addressed with improved memory handling. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. An app with root privileges may be able to execute arbitrary code with kernel privileges.
Exploits (2)
This repository contains a functional proof-of-concept exploit for CVE-2022-32832, a race condition vulnerability in AppleAPFSUserClient::methodDeltaCreateFinalize. The exploit triggers a double-free by racing two calls to the vulnerable method, leading to a kernel panic on vulnerable macOS versions.
This repository contains a functional proof-of-concept exploit for CVE-2022-32832, a race condition vulnerability in AppleAPFSUserClient::methodDeltaCreateFinalize. The exploit triggers a double-free by racing two calls to the vulnerable method, leading to a kernel panic on vulnerable macOS versions.
References (6)
Scores
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H