Apple is well-known for its focus on security, but even their devices can have critical vulnerabilities. One such issue, CVE-2023-38590, was a significant buffer overflow flaw affecting macOS, iOS, tvOS, and watchOS. In this post, I’ll break down what this vulnerability is, how it can be exploited, show you an example code snippet, and offer some links if you want to dig deeper. I’ll keep the language simple and to the point.

What is CVE-2023-38590?

CVE-2023-38590 is a vulnerability caused by a buffer overflow in the kernel, reported by Apple. This means that when the affected system handles device messages, it did not properly check the size of data being copied into memory. If an attacker sends a message that's too big, it overflows the memory buffer, overwriting adjacent memory. This can cause the system to crash unexpectedly (a denial of service), or if exploited carefully, corrupt kernel memory and potentially gain higher privileges.

Here’s the official Apple report

- Apple Security Updates – CVE-2023-38590

What Devices Were Affected?

If you have an Apple device, you were probably affected – unless you’re fully up-to-date. Systems impacted include:

macOS Big Sur: Before 11.7.9

- iOS/iPadOS: Before 15.7.8 and 16.6

macOS Ventura: Before 13.5

The vulnerability has been addressed in the above versions and newer.

How Does the Buffer Overflow Work?

A buffer overflow happens when code copies data into a memory “buffer” without checking if the data is too big for the buffer. Attackers can take advantage of this to overwrite important memory – sometimes leading to code execution or system compromise.

Here is a *very* simplified example in C that demonstrates a classic buffer overflow situation (not Apple's actual code):

#include <stdio.h>
#include <string.h>

void vulnerable_function(char *input) {
    char buffer[16];
    strcpy(buffer, input);  // No length checking!
    printf("Buffer contents: %s\n", buffer);
}

int main(int argc, char *argv[]) {
    if (argc != 2) {
        printf("Usage: %s <input>\n", argv[]);
        return 1;
    }

    vulnerable_function(argv[1]);
    return ;
}

If you run this with a very long argument, you’ll overwrite memory right after buffer, possibly changing the program’s behavior or causing a crash.

Example: Exploiting the Overflow

While Apple hasn’t published a public proof-of-concept exploit, similar vulnerabilities are usually exploited over the network or via a malicious app by sending a specially-crafted message to the vulnerable component.

In the real world, an attacker could create an app or remote service that crafts a device message longer than expected. When the kernel tries to handle it, it overflows a buffer and may execute arbitrary code or crash the device.

How Did Apple Fix It?

Apple fixed the bug by improving the memory handling in the affected code. That usually means adding bounds checking—making sure data that’s copied can’t overflow the buffer.

Here’s what a secure fix would look like in our simple example (again, NOT Apple’s code)

void safe_function(char *input) {
    char buffer[16];
    strncpy(buffer, input, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\'; // Ensure null-termination
    printf("Buffer contents: %s\n", buffer);
}

This way, even if someone tries to input a long string, it won’t overflow buffer.

Should I Worry?

If you’ve updated your Apple device recently, you’re safe. If not, you should update as soon as possible. Apple fixed this in:

- iOS/iPadOS/macOS Monterey/Big Sur/Ventura/tvOS/watchOS updates released July 2023
- Full Apple Release Notes

References

- CVE-2023-38590 on CVE.org
- Apple Security Update July 24, 2023
- Apple Security updates - iOS

Wrapping Up

CVE-2023-38590 is a good reminder that buffer overflows still plague even the most secure systems. All users should keep their devices fully up to date to stay protected from this and similar problems.

Have questions or want more technical details? [Reach out to me!]

Timeline

Published on: 07/28/2023 05:15:10 UTC
Last modified on: 08/03/2023 16:55:34 UTC