CVE-2022-32788
AppleAVD AVC_RBSP::parseSliceHeader ref_pic_list_modification Overflow
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A buffer overflow was addressed with improved bounds checking. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. A remote user may be able to cause kernel code execution.
Se abordó un desbordamiento del búfer con una comprobación de límites mejorada. Este problema es corregido en watchOS versión 8.7, tvOS versión 15.6, iOS versión 15.6 y iPadOS versión 15.6, macOS Monterey versión 12.5. Un usuario remoto puede ser capaz de causar una ejecución de código del kernel
There is a buffer overflow in how AppleAVD.kext parses the ref_pic_list_modification component of H264 slice headers in AVC_RBSP::parseSliceHeader. When pic modification entries are copied into the pic modification list, the loop only terminates when the end code (3) is encountered, meaning that any number of entries can be copied into the fixed size modification buffer. This can corrupt the remainder of the decoder structure, as well as write outside of allocated memory.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-06-09 CVE Reserved
- 2022-07-22 CVE Published
- 2024-05-11 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CAPEC
References (4)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://support.apple.com/en-us/HT213340 | 2022-09-22 | |
| https://support.apple.com/en-us/HT213342 | 2022-09-22 | |
| https://support.apple.com/en-us/HT213345 | 2022-09-22 | |
| https://support.apple.com/en-us/HT213346 | 2022-09-22 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apple Search vendor "Apple" | Ipados Search vendor "Apple" for product "Ipados" | < 15.6 Search vendor "Apple" for product "Ipados" and version " < 15.6" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | < 15.6 Search vendor "Apple" for product "Iphone Os" and version " < 15.6" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Macos Search vendor "Apple" for product "Macos" | >= 12.0.0 < 12.5 Search vendor "Apple" for product "Macos" and version " >= 12.0.0 < 12.5" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Tvos Search vendor "Apple" for product "Tvos" | < 15.6 Search vendor "Apple" for product "Tvos" and version " < 15.6" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Watchos Search vendor "Apple" for product "Watchos" | < 8.7 Search vendor "Apple" for product "Watchos" and version " < 8.7" | - |
Affected
| ||||||