{"id":"CVE-2024-23296","kind":"vulnerability","aliases":["CVE-2024-23296"],"related":[],"title":"A memory corruption issue was addressed with improved validation","description":"A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.6, macOS Sonoma 14.4, macOS Ventura 13.6.7, tvOS 17.4, visionOS 1.1, watchOS 10.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.","summary":"A memory corruption flaw in RTKit, the real-time OS that runs on Apple's coprocessors, in iOS, iPadOS, macOS, tvOS and watchOS. An attacker who already has arbitrary kernel read and write can use it to bypass kernel memory protections.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2024-03-06T00:00:00+00:00","products":[{"name":"Apple Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"apple ipados","fixed":["16.7.8"],"affected":"< 16.7.8","ecosystem":"vendor"},{"name":"apple ipados","fixed":["17.4"],"affected":">= 17.0, < 17.4","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["16.7.8"],"affected":"< 16.7.8","ecosystem":"vendor"},{"name":"apple iphone os","fixed":["17.4"],"affected":">= 17.0, < 17.4","ecosystem":"vendor"},{"name":"apple macos","fixed":["12.7.6"],"affected":">= 12.0, < 12.7.6","ecosystem":"vendor"},{"name":"apple macos","fixed":["13.6.7"],"affected":">= 13.0, < 13.6.7","ecosystem":"vendor"},{"name":"apple macos","fixed":["14.4"],"affected":">= 14.0, < 14.4","ecosystem":"vendor"},{"name":"apple tvos","fixed":["17.4"],"affected":"< 17.4","ecosystem":"vendor"},{"name":"apple visionos","fixed":["1.1"],"affected":"< 1.1","ecosystem":"vendor"},{"name":"apple watchos","fixed":["10.4"],"affected":"< 10.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apple","exploited","infrastructure","ios","ipados","macos","tvos","watchos"],"not_affected_if":["unpatched-builds-not-in-use"],"how_to_check":null,"fix":"Update Apple devices to the latest iOS, iPadOS, macOS, tvOS and watchOS releases, as Apple's security notes for this CVE describe; the exact fixed versions are unknown from the sources.\nCISA's required action is to apply Apple's mitigations or stop using the affected products if none exist.","status":"open","published_at":"2024-03-05T20:16:01+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:00:58+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T21:00:58Z","model":"claude-haiku-5-5","output":{"fix":"Update Apple devices to the latest iOS, iPadOS, macOS, tvOS and watchOS releases, as Apple's security notes for this CVE describe; the exact fixed versions are unknown from the sources.\nCISA's required action is to apply Apple's mitigations or stop using the affected products if none exist.","reach":"local","impact":"high","summary":"A memory corruption flaw in RTKit, the real-time OS that runs on Apple's coprocessors, in iOS, iPadOS, macOS, tvOS and watchOS. An attacker who already has arbitrary kernel read and write can use it to bypass kernel memory protections.","category":"infrastructure","who_cares":["apple","ios","macos","ipados","watchos","tvos"],"confidence":0.5,"needs_auth":"yes","worst_case":"attacker with kernel read/write bypasses kernel memory protections on Apple devices","analyst_note":"Find Apple's security content page for CVE-2024-23296 to get fixed versions and check how the flaw is reached in practice; the sources only give KEV listing and no affected or fixed versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unpatched-builds-not-in-use"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000516,"input_tokens":2838,"output_tokens":464,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':11A,14A '-23296':12A,15A '1.1':127C '10.4':129C '12.7.6':117C '13.6.7':123C '14.4':120C '16.7.8':106C,109C '17.4':111C,114C,125C 'abl':141C 'address':6A,96C 'alreadi':76B 'appl':41B,63B,147C 'apple':16A,19A,21A,23A,26A,29A,31A,33A,35A,37A,39A 'arbitrari':78B,133C 'attack':74B,131C 'awar':149C 'bypass':87B,143C 'capabl':138C 'coprocessor':65B 'corrupt':3A,51B,93C 'cve':10A,13A 'exploit':42B,159C 'fix':103C 'flaw':52B 'improv':8A,98C 'infrastructur':43B 'io':44B,67B,105C,110C 'ipado':45B,68B,108C,113C 'ipados':20A,22A 'iphone':24A,27A 'issu':4A,94C,101C,155C 'kernel':79B,88B,134C,144C 'maco':46B,69B,115C,118C,121C 'macos':30A,32A,34A 'may':139C,156C 'memori':2A,50B,89B,92C,145C 'monterey':116C 'multiple':17A 'os':25A,28A,59B 'products':18A 'protect':90B,146C 'read':80B,135C 'real':57B 'real-tim':56B 'report':152C 'rtkit':54B 'run':61B 'sonoma':119C 'time':58B 'tvos':36A,47B,70B,124C 'use':84B 'valid':9A,99C 'ventura':122C 'visiono':126C 'visionos':38A 'watcho':48B,72B,128C 'watchos':40A 'write':82B,137C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-03-05T20:16:01+00:00","kev":{"dateAdded":"2024-03-06","dueDate":"2024-03-27","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-23296","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-23296","severity":null,"published_at":"2024-03-06T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T17:39:56+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-23296","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23296","severity":null,"published_at":"2024-03-05T20:16:01+00:00","modified_at":"2026-06-17T07:12:32+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}