Sign-up

ID

VAR-202212-1290


CVE

CVE-2022-42821


TITLE

apple's  macOS  Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-023660

DESCRIPTION

A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Big Sur 11.7.2, macOS Ventura 13. An app may bypass Gatekeeper checks. apple's macOS Exists in unspecified vulnerabilities.Information may be tampered with. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2022-12-13-5 macOS Monterey 12.6.2 macOS Monterey 12.6.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213533. Bluetooth Available for: macOS Monterey Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2022-42854: Pan ZhenPeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. CVE-2022-42821: Jonathan Bar Or of Microsoft DriverKit Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2022-32942: Linus Henze of Pinauten GmbH (pinauten.de) File System Available for: macOS Monterey Impact: An app may be able to break out of its sandbox Description: This issue was addressed with improved checks. CVE-2022-42861: pattern-f (@pattern_F_) of Ant Security Light-Year Lab IOHIDFamily Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved state handling. CVE-2022-42864: Tommy Muir (@Muirey03) Kernel Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with additional validation. CVE-2022-46689: Ian Beer of Google Project Zero Kernel Available for: macOS Monterey Impact: An app with root privileges may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2022-42845: Adam Doupé of ASU SEFCOM Kernel Available for: macOS Monterey Impact: A remote user may be able to cause kernel code execution Description: The issue was addressed with improved memory handling. CVE-2022-42842: pattern-f (@pattern_F_) of Ant Security Light-Year Lab libxml2 Available for: macOS Monterey Impact: A remote user may be able to cause unexpected app termination or arbitrary code execution Description: An integer overflow was addressed through improved input validation. CVE-2022-40303: Maddie Stone of Google Project Zero libxml2 Available for: macOS Monterey Impact: A remote user may be able to cause unexpected app termination or arbitrary code execution Description: This issue was addressed with improved checks. CVE-2022-40304: Ned Williamson and Nathan Wachholz of Google Project Zero ppp Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: The issue was addressed with improved memory handling. CVE-2022-42840: an anonymous researcher Preferences Available for: macOS Monterey Impact: An app may be able to use arbitrary entitlements Description: A logic issue was addressed with improved state management. CVE-2022-42855: Ivan Fratric of Google Project Zero xar Available for: macOS Monterey Impact: Processing a maliciously crafted package may lead to arbitrary code execution Description: A type confusion issue was addressed with improved checks. CVE-2022-42841: Thijs Alkemade (@xnyhps) of Computest Sector 7 macOS Monterey 12.6.2 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEBP+4DupqR5Sgt1DB4RjMIDkeNxkFAmOZFX8ACgkQ4RjMIDke NxmuDw/7B+dpr+R5V7L8iLPTeaWmYdo95V9eKbSoUaNMWy+zqAMTpjpybr8t04KE SlKg1LGUBtE0Yu+Hk8XH5w9cp9EmthJlViaQj/ARhQnaJAb6d4c7fVE/b70aFlB2 LyGSwW7J2U7jJVT/DLNJRLPy57hql9hCONY0qZzGvF7cogjeyy3CKQx6JQoRcxP+ BkwSgXX1BxscWkjtQkNnDEDJYWj04MxmTj+EVeoOmkDlXcSypYCBEAKz7474Hnql /lZYe8a+SupwOrXnJUusobAK8fUDN7tfmrr5Zg6F7mBGe6BDNX7E6BZ3hb8NH/sz w0BBUU4aLCAVFbgllNLGQqsWif4/julEaSneEtStrJDgNWaXbrhrTWAYzMfJIGoF nGWYmWUY8YR53zeC1egMvHoHnLFzIXGOWmKdWhahSMygHb1R5i8wdCcv+M1iL3BB pthnd3XnZiOcEo4Z2XazFJV2YQ6juDPcXFgS0fBsNBS7LvMKBia/ax3CGwAxEagM yLOgcgIIbdg6DM72siMOpfScB7EPcFIBb1H6IHBZMhRg0NRKMTB9tNE0rgQ+OYUN Ze1wkPo8FH1lCunDcSZ1v6JzGZRN/o3woaR3LHVYEPWe3zJY2YvaqRrD/QfjqsMm 5o/94MyoeFn0WM6lXhqlBZvn8HtYDmFNu4VFt6ZjiL13CohaL2U= =U7h6 -----END PGP SIGNATURE-----

Trust: 1.98

sources: NVD: CVE-2022-42821 // JVNDB: JVNDB-2022-023660 // VULHUB: VHN-439605 // VULMON: CVE-2022-42821 // PACKETSTORM: 170316 // PACKETSTORM: 170315

AFFECTED PRODUCTS

vendor:applemodel:macosscope:ltversion:11.7.2

Trust: 1.0

vendor:applemodel:macosscope:ltversion:12.6.2

Trust: 1.0

vendor:applemodel:macosscope:gteversion:11.0

Trust: 1.0

vendor:applemodel:macosscope:gteversion:12.0.0

Trust: 1.0

vendor:アップルmodel:macosscope:eqversion:11.0 that's all 11.7.2

Trust: 0.8

vendor:アップルmodel:macosscope:eqversion:12.0.0 that's all 12.6.2

Trust: 0.8

vendor:アップルmodel:macosscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-023660 // NVD: CVE-2022-42821

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2022-42821
value: MEDIUM

Trust: 1.8

CNNVD: CNNVD-202212-3160
value: MEDIUM

Trust: 0.6

NVD:
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2022-42821
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-023660 // NVD: CVE-2022-42821 // CNNVD: CNNVD-202212-3160

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:Lack of information (CWE-noinfo) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-023660 // NVD: CVE-2022-42821

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202212-3160

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202212-3160

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2022-42821

PATCH
title:HT213533 Apple  Security updateurl:https://support.apple.com/en-us/ht213488
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2022-023660

EXTERNAL IDS
db:NVDid:CVE-2022-42821
Trust: 3.6
db:PACKETSTORMid:170316
Trust: 0.8
db:JVNDBid:JVNDB-2022-023660
Trust: 0.8
db:CNNVDid:CNNVD-202212-3160
Trust: 0.6
db:PACKETSTORMid:170315
Trust: 0.2
db:VULHUBid:VHN-439605
Trust: 0.1
db:VULMONid:CVE-2022-42821
Trust: 0.1
sources:
            
            
            VULHUB: VHN-439605 // 
            
            
            
            VULMON: CVE-2022-42821 // 
            
            
            
            JVNDB: JVNDB-2022-023660 // 
            
            
            
            PACKETSTORM: 170316 // 
            
            
            
            PACKETSTORM: 170315 // 
            
            
            
            NVD: CVE-2022-42821 // 
            
            
            
            CNNVD: CNNVD-202212-3160

REFERENCES
url:http://seclists.org/fulldisclosure/2022/dec/24
Trust: 2.5
url:http://seclists.org/fulldisclosure/2022/dec/25
Trust: 2.5
url:https://support.apple.com/en-us/ht213534
Trust: 2.4
url:https://support.apple.com/en-us/ht213488
Trust: 1.8
url:https://support.apple.com/en-us/ht213533
Trust: 1.8
url:https://nvd.nist.gov/vuln/detail/cve-2022-42821
Trust: 1.0
url:https://cxsecurity.com/cveshow/cve-2022-42821/
Trust: 0.6
url:https://vigilance.fr/vulnerability/apple-ios-macos-multiple-vulnerabilities-of-december-2022-40105
Trust: 0.6
url:https://packetstormsecurity.com/files/170316/apple-security-advisory-2022-12-13-6.html
Trust: 0.6
url:https://nvd.nist.gov/vuln/detail/cve-2022-42841
Trust: 0.2
url:https://www.apple.com/support/security/pgp/
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-42840
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-42842
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-42845
Trust: 0.2
url:https://support.apple.com/en-us/ht201222.
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-40303
Trust: 0.2
url:https://support.apple.com/downloads/
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-42864
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-40304
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-46689
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-32942
Trust: 0.2
url:https://nvd.nist.gov
Trust: 0.1
url:https://support.apple.com/ht213534.
Trust: 0.1
url:https://support.apple.com/ht213533.
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-42861
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-42854
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-42855
Trust: 0.1
sources:
            
            
            VULHUB: VHN-439605 // 
            
            
            
            VULMON: CVE-2022-42821 // 
            
            
            
            JVNDB: JVNDB-2022-023660 // 
            
            
            
            PACKETSTORM: 170316 // 
            
            
            
            PACKETSTORM: 170315 // 
            
            
            
            NVD: CVE-2022-42821 // 
            
            
            
            CNNVD: CNNVD-202212-3160

CREDITS
Apple
Trust: 0.2
sources:
            
            
            PACKETSTORM: 170316 // 
            
            
            
            PACKETSTORM: 170315

SOURCES
db:VULHUBid:VHN-439605
db:VULMONid:CVE-2022-42821
db:JVNDBid:JVNDB-2022-023660
db:PACKETSTORMid:170316
db:PACKETSTORMid:170315
db:NVDid:CVE-2022-42821
db:CNNVDid:CNNVD-202212-3160

LAST UPDATE DATE
2023-12-18T11:10:17.294000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-439605date:2023-01-09T00:00:00
db:VULMONid:CVE-2022-42821date:2022-12-15T00:00:00
db:JVNDBid:JVNDB-2022-023660date:2023-11-29T05:40:00
db:NVDid:CVE-2022-42821date:2023-01-09T16:59:53.433
db:CNNVDid:CNNVD-202212-3160date:2022-12-30T00:00:00

SOURCES RELEASE DATE
db:VULHUBid:VHN-439605date:2022-12-15T00:00:00
db:VULMONid:CVE-2022-42821date:2022-12-15T00:00:00
db:JVNDBid:JVNDB-2022-023660date:2023-11-29T00:00:00
db:PACKETSTORMid:170316date:2022-12-22T02:12:32
db:PACKETSTORMid:170315date:2022-12-22T02:12:10
db:NVDid:CVE-2022-42821date:2022-12-15T19:15:22.950
db:CNNVDid:CNNVD-202212-3160date:2022-12-13T00:00:00