CVE-2017-13867

Think of the device’s “Kernel” as the core control center for the system. This flaw lets a malicious app, once you get it installed and running, potentially break into that control center—either taking full control of the device or causing serious crashes. It’s like giving a “wrongdoer” a way to interfere with the device’s core plumbing after you invite them in.

This matters if you run or manage Apple devices using older operating systems: iOS before 11.2, macOS before 10.13.2, tvOS before 11.2, or watchOS before 4.2. It’s not a background drive-by risk in the default setup; an attacker still needs local access and must get you to install or run a malicious app. Only consider it a practical risk if you (or your staff) might install and run untrusted apps on those devices.

This should be treated as a priority update because the flaw can allow a malicious app to execute code with the device’s highest privileges or crash the device. Even though it needs user action (running a malicious app), the availability of a public exploit means attackers may already be able to weaponize it. Per the traffic-light verdict, plan to update promptly (AMBER).

Confirm whether you’re exposed

1. On each affected device, check the OS version.
   • iOS/iPadOS: Settings → General → About → iOS Version.
   • macOS: Apple menu → System Settings/Preferences → About → macOS Version.
   • tvOS: Settings → General → About → tvOS Version.
   • watchOS: Watch app on iPhone → General → About → watchOS Version.
2. Determine whether any device is on a vulnerable version:
   • iOS: earlier than 11.2
   • macOS: earlier than 10.13.2
   • tvOS: earlier than 11.2
   • watchOS: earlier than 4.2

Patch (recommended fix)

1. Upgrade each device to the first fixed release:
   • iOS → 11.2 or later
   • macOS → 10.13.2 or later
   • tvOS → 11.2 or later
   • watchOS → 4.2 or later
2. After updating, re-check the OS version to confirm it changed.

If you can’t patch immediately (workaround)

• Do not install or run apps from untrusted sources.
• Remove any recently installed apps that you can’t account for, especially if they appeared around the same time as suspicious behavior (unexpected pop-ups, crashes, odd logins).
• Restrict app installation to approved sources through your organization’s normal device management practices (if you use them).

CISA KEV / exploitation status

• This issue is not listed in the CISA Known Exploited Vulnerabilities (KEV) list per the provided findings.
• A public exploit exists, and press attention is rising; update urgency remains high.

What to monitor after patching

• Device stability (crash frequency) and any signs of unusual app behavior.
• If you have device management/logging, review for newly installed/unapproved apps around the time of any incident.

Severity context: rated HIGH (CVSS 7.8) in the provided material.

Weakness type: CWE-119 (memory corruption), specifically in the Apple Kernel component.

Mechanism / attack trigger: Local attack vector; no authentication is required, but user interaction is required. In practice, the attacker needs local access and must get the victim to install or run a specifically crafted malicious application. The successful outcome can be arbitrary code execution in a privileged context (highest privileges) or denial of service (device stop/crash due to bad data).

Exploitation maturity: A public exploit is available (1 known). KEV listing was not provided (not listed in CISA KEV), so confirmed widespread exploitation is not established by KEV in the findings.

Patch status (fixed versions): iOS fixed in 11.2; macOS fixed in 10.13.2; tvOS fixed in 11.2; watchOS fixed in 4.2.

EPSS: A prediction is given in the findings, but it’s not used for public urgency messaging here (and there is no KEV confirmation to override it in the provided sources).