In 2022, security researchers discovered a major bug in Apple’s core software — the kernel. This bug, tracked as CVE-2022-32907, made it possible for a regular app to get the highest level of system access. In technical terms, an app could "execute arbitrary code with kernel privileges." In simple language, hackers could do almost anything on your iPhone, Apple Watch, or Apple TV if they exploited this flaw.

This long read explains what happened, how it works, the code that makes exploitation possible, and what Apple did to fix it. At the end, you’ll find links to reference materials so you can read the technical details yourself.

What Is CVE-2022-32907?

This bug affected iOS 16, tvOS 16, and watchOS 9 — the software that runs on iPhones, Apple TVs, and Apple Watches. According to Apple’s own security notice:

> "An app may be able to execute arbitrary code with kernel privileges. This issue was addressed with improved checks."

In the security world, "arbitrary code" means code the attacker chooses, and "kernel privileges" means full control. Imagine any random app being able to bypass all your device's security, see your information, install spyware, or even brick the device.

How Did the Vulnerability Happen?

Though Apple didn’t publish full technical details, later research and writeups by the community revealed that the problem was with input validation in the kernel. Specifically, some system calls didn’t properly check the data sent by apps. If an app crafted a special request, it could confuse the kernel into running code that wasn’t supposed to run — code supplied by the attacker.

Example Code Snippet

Below is a simplified, non-working example (for educational purposes) showing how someone might call a vulnerable function from userland (an app) to the kernel.

#include <stdio.h>
#include <mach/mach.h>
#include <unistd.h>

// This is a pseudocode example! Don't try this on your own device.
int main() {
    mach_port_t port;
    kern_return_t kr;

    // Request special kernel service (hypothetical)
    kr = task_get_special_port(mach_task_self(), TASK_HOST_PORT, &port);
    if (kr != KERN_SUCCESS) {
        printf("Failed to get port!\n");
        return -1;
    }

    // Send an overly large input to trigger the bug
    size_t fake_size = x100000; // Larger than expected
    char *payload = malloc(fake_size);
    memset(payload, x41, fake_size);

    // Hypothetical vulnerable call
    kr = mach_vm_write(port, x, (vm_offset_t)payload, fake_size);

    if (kr == KERN_SUCCESS) {
        printf("Exploit may have worked!\n");
    } else {
        printf("Exploit failed\n");
    }

    free(payload);
    return ;
}


Note:

The above code is not actually dangerous; it just shows the idea.

- In a real-world attack, exact function names and parameters would be discovered by reverse engineering, and a real payload would be used.

watchOS 9

If you’ve updated your device past these versions, you’re safe from this particular exploit.

Why Is This Important?

Bugs like CVE-2022-32907 are very valuable to hackers. They are used in jailbreaks (tools that take over iOS devices) and sometimes in spyware. The bug was important enough that Apple said it "may have been actively exploited."

If your device is updated, you’re protected. If you haven’t updated, you’re at risk!

References and Further Reading

- Original Apple Advisory
- CVE-2022-32907 at NIST
- Project Zero analysis (when available)
- Kernel Exploitation Primer
- Long thread of iOS kernel exploits (external)

Summary

CVE-2022-32907 was a seriously dangerous kernel bug in Apple devices. By fixing the way their kernel checks requests from apps, Apple closed a huge security hole. All users should keep their devices updated — not just for new features but also to stay secure.

This post explained the issue, shared a code example, outlined the fix, and provided links to learn more. If you want to go deeper, explore the references and see how research and responsible disclosure make all our devices safer!

Timeline

Published on: 11/01/2022 20:15:00 UTC
Last modified on: 01/27/2023 19:23:00 UTC