CVE-2023-42824: Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability
What It Is — An unspecified kernel flaw in Apple iOS and iPadOS permits a local attacker to elevate privileges to root. The vulnerability is tracked as CVE‑2023‑42824 and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Exploitability — No public exploit has been released, but the vulnerability is classified as “high” severity (CVSS ≈ 8.8) and can be weaponized by an adversary with physical or remote code‑execution foothold on the device.
Affected Products — All iPhone and iPad models running iOS 16.5, iPadOS 16.5, and earlier versions that include the vulnerable kernel component. Apple has issued a security update (iOS 16.6 / iPadOS 16.6) that addresses the issue.
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – A kernel‑level privilege jump bypasses OS‑level access controls, undermining the “least‑privilege” principle that underpins many control frameworks.
- Continuous evidence of remediation – Demonstrating that devices are patched promptly provides audit‑ready evidence of due‑diligence for regulators and enterprise buyers.
- Defensible incident response – Knowing that a critical OS flaw exists forces organizations to tighten monitoring for anomalous privileged activity, a key control for a credible incident‑response posture.
Recommended Actions
- Deploy Apple’s iOS 16.6 / iPadOS 16.6 update (or later) across all managed devices immediately.
- Verify patch compliance through your MDM solution and retain proof‑of‑patch logs for audit purposes.
- Enforce strict “no‑root” policies and enable runtime integrity monitoring to detect unexpected privilege escalations.
- Update your access‑control baselines to reflect the patched state and document the change in your control‑mapping repository.
Source: CISA KEV – CVE‑2023‑42824