Apple devices are widely known for their strong focus on security and privacy. Yet, even these robust ecosystems are not immune to critical vulnerabilities. One such issue, CVE-2023-38606, made headlines for its impact on the core of Apple's most cherished devices: the kernel. In this long read, we'll break down CVE-2023-38606 in simple language—how it works, why it matters, who it affected, and what you can do about it. You'll also find code snippets, references, and a look into the bug's exploitation in the wild.

What is CVE-2023-38606?

CVE-2023-38606 is a security vulnerability discovered in Apple’s kernel—the heart of operating systems like iOS, iPadOS, macOS, watchOS, and tvOS. At its core, this bug allowed a malicious app to modify sensitive kernel state, leading to potentially severe consequences. Apple has acknowledged reports that this issue may have been actively exploited—meaning attackers could have hijacked devices in the wild, specifically those using versions of iOS released before *iOS 15.7.1*.

What Devices and Versions Are Affected?

If you are (or were) using any of the following before updating to the latest patch, your device could have been vulnerable:

The Technical Details – What Really Happened?

The vulnerability existed due to improper state management in the kernel. The kernel is a low-level component that interacts directly with hardware and handles permission checks. If a rogue application finds a way to change the kernel's internal state, it can bypass security rules, escalate privileges, access protected data, or crash the system.

Apple’s update notes simply say:  
> “This issue was addressed with improved state management.”

In Plain English

Someone created an app that, through a bug, tricked the kernel into making changes it shouldn't have allowed—effectively opening a backdoor into your device's most sensitive internals.

Code Snippet: What Might An Exploit Look Like?

While Apple and security researchers often do not release *public* proof-of-concept code for actively exploited kernel vulnerabilities, we can illustrate a simplified conceptual snippet of what kind of approach attackers might use to trigger the bug.

// This is a conceptual demonstration, not actual exploit code!

#include <IOKit/IOKitLib.h>

int main() {
    // Obtain a connection to a vulnerable IOService
    io_service_t service = IOServiceGetMatchingService(kIOMasterPortDefault,
                              IOServiceMatching("AppleVulnerableService"));

    if (service) {
        io_connect_t connect = ;
        kern_return_t kr = IOServiceOpen(service, mach_task_self(), , &connect);
        if (kr == KERN_SUCCESS) {
            // Send malformed input to trigger the vulnerability
            uint64_t inputScalar[16] = {};
            size_t inputScalarCnt = 16;

            kr = IOConnectCallScalarMethod(connect, , inputScalar, inputScalarCnt, NULL, NULL);

            if (kr != KERN_SUCCESS) {
                printf("Failed, but system remains safe.\n");
            }
        }
    }

    return ;
}


Note:

This code is not functional or dangerous by itself.

- Real-world exploits exploit specific IOKit/driver bugs or kernel interfaces.

Malware in the Wild: Active Exploitation

Apple confirmed that CVE-2023-38606 was exploited in the wild—meaning real attackers used this hole before it was fixed. This often happens in *targeted attacks* against specific people, such as journalists, activists, or high-value targets.

Researchers believe this vulnerability may have been linked to advanced spyware, sometimes referenced as "zero-click" exploits that require no user interaction.

References

- Apple Security Advisory - CVE-2023-38606
- The Record by Recorded Future: 3 new zero-day bugs patched by Apple

In their patch notes, Apple said the issue was

> "...addressed with improved state management."

This means they hardened the code so that only legitimate, verified actions are allowed to change kernel states—closing the loophole attackers were using.

Update your device.

Go to Settings -> General -> Software Update and ensure you are running the latest OS for your Apple device.

Conclusion

CVE-2023-38606 was a serious kernel flaw that allowed potentially devastating attacks on nearly every type of Apple device. While this bug has been fixed in the latest updates, its active exploitation shows how critical it is for all users to stay updated.

If you’d like to learn more, dig into these original resources

- Apple Security Updates
- Apple Security Advisory for CVE-2023-38606

Stay safe, keep your devices updated, and remember: even the most secure systems need your help to stay that way.


Author:  
A security enthusiast making Apple security simple for everyone.

Timeline

Published on: 07/27/2023 00:15:16 UTC
Last modified on: 08/01/2023 20:01:33 UTC