CVE-2023-27937 - Breaking Down the Plist Integer Overflow Vulnerability in Apple Devices

Apple products are known for their security, but sometimes critical vulnerabilities sneak through the cracks. One such bug is CVE-2023-27937, an integer overflow vulnerability fixed across multiple Apple platforms in early 2023. In this deep dive, we’ll explore what CVE-2023-27937 is, how it could be exploited, and how Apple patched it. Whether you’re a curious user or a budding security researcher, this post aims to explain things in a simple, approachable manner.

What is CVE-2023-27937?

CVE-2023-27937 is a security flaw related to how Apple devices process plist (property list) files. Specifically, it is an integer overflow that occurs during the parsing of a specially-crafted plist, potentially letting an attacker crash an application or even execute arbitrary code on your device.

watchOS (Fixed in 9.4)

To check if you’re safe, make sure your devices are updated to at least these versions!

Technical Details: How the Vulnerability Works

A plist (property list) is an Apple-specific format for storing data. Many Apple apps, and third-party apps, routinely read and write these files.

If an attacker sends a malicious plist file, specially crafted to cause an integer overflow (meaning, a number gets too big or too small for the app to handle), the app might accidentally execute arbitrary code or simply crash.

Because of integer overflow, the calculation wraps around to a small number.

5. The app now allocates a tiny buffer and then reads a large amount of data into it, causing a buffer overflow.
6. This can lead to unexpected app termination (crash) or… more dangerously, provide a route for code execution!

Example: Simulated Integer Overflow in Swift

The real vulnerable code is inside Apple’s closed source, but we can imagine what a simplified, unsafe version might look like:

// BAD: Simulates unsafe plist parsing

func parsePlist(data: Data) {
    // Suppose the header tells us the size of the payload
    let payloadSize = Int(data[]) // Attacker-controlled value

    // Vulnerable allocation: no check if payloadSize is sane
    var buffer = [UInt8](repeating: , count: payloadSize)

    // Reading data into the buffer (potential overflow!)
    for i in ..<payloadSize {
        buffer[i] = data[i+1] // If payloadSize > data.count, boom!
    }
}

If the attacker sends a payloadSize that overflows the integer, the actual buffer could be much smaller or larger than expected, causing memory corruption.

Safer code (what Apple now does)

// GOOD: Checks for overflow

func parsePlist(data: Data) {
    guard data.count > 1 else { return }
    let payloadSize = Int(data[])

    // Validate payloadSize does not exceed bounds
    guard payloadSize >  && payloadSize < (data.count - 1) else { return }

    var buffer = [UInt8](repeating: , count: payloadSize)
    for i in ..<payloadSize {
        buffer[i] = data[i+1]
    }
}

Apple’s patch added input validation to ensure no integer overflows and that plist sizes make sense.

Writing a Malicious Plist (Hypothetical Example)

Here’s a minimal example of crafting a malicious plist in XML form (not an actual exploit, but illustrative):

<?xml version="1." encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.//EN" "http://www.apple.com/DTDs/PropertyList-1..dtd">;
<plist version="1.">
    <dict>
        <key>buffer_length</key>
        <integer>4294967295</integer>  <!-- Max 32-bit integer -->
        <key>data</key>
        <data>
        AA==
        </data>
    </dict>
</plist>

If an app trusted the buffer_length to allocate space, this massive number could wrap to and cause the buffer overflow scenario described above.

Attackers could convince users to open a malicious app or file.

- On iOS, a compromised app could use this to try to escape its sandbox or attack other parts of the phone.

Real-world impacts:

App crash (annoyance or denial-of-service).

- Arbitrary code execution (dangerous!): If the attacker exploits the overflow just right, they might run custom code on your device.

How Apple Fixed It

From Apple’s security advisories, they simply say:
"An integer overflow was addressed with improved input validation."
This is best practice — double-check all numbers from files before trusting them!

References

- Apple Security Update for CVE-2023-27937
- Apple Security Research site for CVE-2023-27937

Are You at Risk?

If you keep your Apple devices up to date, you should be safe. This vulnerability got a patch in spring 2023 for all affected platforms.

Not updated? Update your devices right now. Plist bugs can be chained with others for more serious attacks.

Conclusion

CVE-2023-27937 is a sobering reminder that even carefully-designed systems are only as secure as their code. Integer overflows have been a plague for decades – and this bug shows why all code handling user input, especially in binary formats, must be extra careful. Apple’s patch was simple but critical: validate all input.

Stay safe. Keep your devices updated. And remember to treat all file parsers — even “boring” ones like plist — with respect.

*This post is an exclusive breakdown for educational purposes. Don’t use this information for anything unethical — use it to make your code safer!*

Timeline

Published on: 05/08/2023 20:15:00 UTC
Last modified on: 05/19/2023 16:15:00 UTC