CVE-2023-42824

HIGHCISA KEV

Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability

Title source: CISA
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-42824 has a selected CVSS score of 7.8 (high); EIP currently links 1 repository PoC. CISA lists CVE-2023-42824 in KEV.

Description

The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.

Description source: CVE List

Exploitation context

Known exploitation

CISA KEV
Listed · Oct 5, 2023 · CISA
VulnCheck KEV
Listed · Oct 4, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationActive
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 15, 2023 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

iOS and iPadOS

Browse Apple / iOS and iPadOS
CISA, CVE ListBefore 16.7affected

Proofs of concept

1

Repository PoCs

GitHub619555798/cve-2023-42824Repository PoCby 6195557983Exploit16 files

89.8 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A multi-threaded C program that exploits a copy-on-write (COW) bypass vulnerability (payload withheld) in the XNU kernel's virtual memory subsystem. It uses Mach out-of-line (OOL) memory messages and concurrent page faults to trigger a race condition, allowing a writer thread's modifications to become visible through a supposedly COW-mapped copy, demonstrating privilege escalation capability.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and two C source files implementing a proof-of-concept for payload withheld, a local privilege escalation via a copy-on-write bypass. The code performs memory mapping, remapping, and race-condition exploitation using Mach APIs, which is consistent with the stated vulnerability. No backdoor, deceptive payload, or concealed operator-directed harm is observed. The code does not establish persistence, exfiltrate data, or execute unrelated commands.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesC
Target softwareXNU kernel (iOS/macOS)
Attack typesrace conditionprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exercises a race condition to achieve a COW bypass, which is the vulnerability itself. It does not merely check for the vulnerability; it performs the write, detects the bypass, and logs success. This is exploit behavior, not a scanner.

mdc2/vm_fault_poc.c:460-528

Requirements

  • Local code execution on a vulnerable XNU kernel version (iOS before 16.7.1 or 17.0.3).mdc2/vm_fault_poc.c:1

Observed behavior

  • Creates a shared memory mapping and a remapped copy via mach_vm_remap, then spawns writer, copy-churn, and fault-contention threads to race writes against OOL message sends. Detects when a writer's value appears in the OOL copy, confirming a COW bypass, and logs the event.mdc2/vm_fault_poc.c:246-543
  • Uses mach_vm_protect to flip page protections and induce faults, increasing race window.mdc2/vm_fault_poc.c:339-369
  • Logs successful COW bypass with page number and confirmation method.mdc2/vm_fault_poc.c:520-522
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Exploit
Payload withheldThe code implements a race condition to bypass copy-on-write protections, matching the described local privilege escalation vulnerability.mdc2/vm_fault_poc.c:1-819
Mach Api Usage
Payload withheldThe PoC uses Mach VM APIs to manipulate memory mappings and trigger the vulnerability, which is expected for an iOS/macOS kernel exploit.mdc2/vm_fault_poc.c:19-26mdc2/vm_fault_poc.c:413-418
Review boundaries

What the analysis did not establish

  • One binary file (UserInterfaceState.xcuserstate) was not analyzed; it is unlikely to affect classification.
  • Only 3 of 15 text files were included; the remaining 12 files are omitted, but the included files contain the core exploit logic.
  • One binary file (UserInterfaceState.xcuserstate) was flagged but not analyzed; it is a standard Xcode user state file and unlikely to contain executable payloads.
  • Only 3 of 16 total files were provided as text; the remaining 12 text files were omitted due to size constraints, but the core exploit logic is fully represented.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

8