CVE-2017-2472

This is a security flaw in the “kernel,” the core part of the operating system that controls how the device runs. A malicious app could use it to either take over with very high privileges or cause the device to crash. Think of it like a weakness in the building’s foundation: if someone exploits it, they can potentially control the whole building or knock it over.

This matters if your business uses iPhones/iPads (iOS), Macs (macOS), Apple TVs (tvOS), or Apple Watches (watchOS) with OS versions older than: iOS 10.3, macOS 10.12.4, tvOS 10.2, or watchOS 3.2. The risk is tied to whether attackers can get a crafted app onto the device and get it to run, and it targets the device’s kernel while the app is executing.

This is urgent (Amber) because a public exploit is available, meaning attackers have a practical path to attempt real-world compromise rather than just a theoretical issue. Even though CISA’s known-exploited list does not currently include this CVE, the available exploit and the rising attention make it a priority for businesses with unmanaged or outdated Apple devices.

1. Inventory and version-check (confirm exposure)

   • For each device type:
     • iOS: open Settings → General → About → iOS Version.
     • macOS: Apple menu → System Settings/Preferences → About → macOS Version.
     • tvOS: Settings → General → About → Version.
     • watchOS: iPhone Watch app → General → About → watchOS Version.
   • Confirm whether any devices are on:
     • iOS before 10.3
     • macOS before 10.12.4
     • tvOS before 10.2
     • watchOS before 3.2

2. Upgrade to the fixed versions (primary remediation)

   • Update any affected devices to at least:
     • iOS 10.3 or later
     • macOS 10.12.4 or later
     • tvOS 10.2 or later
     • watchOS 3.2 or later
   • Use Apple’s official guidance for updating (refer to the vendor remediation links provided by the findings):
     • https://support.apple.com/HT207617
     • https://support.apple.com/HT207601
     • https://support.apple.com/HT207602
     • https://support.apple.com/HT207615
     • https://support.apple.com/HT207617

3. If patching is delayed (workaround to reduce risk)

   • Limit app installation/usage to trusted sources (avoid installing untrusted apps).
   • Reduce the likelihood that unknown/crafted apps get executed by users.
   • If your organization uses device management, tighten policies to restrict app installs and downloads until updates are complete.

4. Verification

   • Re-check each device’s OS version after the update.
   • Confirm update completion and that the device remains stable.

5. What to monitor

   • Look for signs of unexpected app behavior, crashes, or device instability around the time of any app installs/launches.
   • Since exploitation involves a crafted app triggering a kernel weakness, prioritize monitoring for unusual installs from unknown sources.

Severity is rated HIGH (with a CVSS of 7.8 in the prompt). The weakness is categorized as CWE-416 (Use After Free). The issue is in the kernel component and can be triggered via a crafted app to either execute arbitrary code in a privileged context or cause denial of service (use-after-free). Findings indicate public exploit availability (1 known exploit), and press attention is rising; however, KEV (CISA known exploited) is not listed for this CVE. EPSS is reported as 10.0% with a rising trend, but no KEV/news confirmation is provided in the findings, so public probability should not be treated as a deciding factor. Overall exploit maturity is practical enough to warrant immediate patching for affected versions because a public exploit exists.