CVE-2023-42917: Apple Safari RCE Vulnerability

CVE-2023-42917 Overview

CVE-2023-42917 is a memory corruption vulnerability in Apple WebKit, the browser engine powering Safari and other Apple applications. The vulnerability exists due to improper locking mechanisms during web content processing, which can lead to arbitrary code execution when a victim visits a maliciously crafted webpage. Apple has confirmed that this vulnerability has been actively exploited in the wild against iOS versions prior to iOS 16.7.1, making it a critical security concern for all Apple device users.

Critical Impact
This vulnerability enables remote attackers to execute arbitrary code on affected devices through malicious web content. Active exploitation has been confirmed by Apple, and the vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Affected Products

Apple Safari (versions prior to 17.1.2)
Apple iOS (versions prior to 17.1.2)
Apple iPadOS (versions prior to 17.1.2)
Apple macOS Sonoma (versions prior to 14.1.2)
Debian Linux 11.0 and 12.0 (WebKitGTK+)
Fedora 38 and 39 (WebKitGTK+)
WebKitGTK+

Discovery Timeline

2023-11-30 - CVE-2023-42917 published to NVD
2025-10-23 - Last updated in NVD database

Technical Details for CVE-2023-42917

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-bounds Write), a type of memory corruption flaw that occurs when a program writes data outside the boundaries of allocated memory. In the context of WebKit, the memory corruption issue stems from inadequate locking mechanisms during the processing of web content.

When WebKit processes complex web content involving JavaScript execution and DOM manipulation, concurrent operations may access shared memory regions without proper synchronization. This race condition can corrupt memory structures, leading to a state where an attacker can influence program execution flow.

The vulnerability requires user interaction—specifically, a victim must navigate to an attacker-controlled or compromised webpage. Once triggered, the memory corruption can be leveraged to achieve arbitrary code execution within the context of the WebKit process, potentially allowing full device compromise depending on the attack chain employed.

Root Cause

The root cause of CVE-2023-42917 lies in insufficient locking mechanisms within WebKit's memory management routines. During concurrent web content processing operations, shared memory regions were not adequately protected with synchronization primitives. This allowed race conditions to occur where multiple execution threads could simultaneously read from and write to the same memory locations, resulting in memory corruption.

Apple addressed this issue by implementing improved locking mechanisms to ensure proper thread synchronization during critical memory operations in the WebKit engine.

Attack Vector

The attack vector for this vulnerability is network-based and requires user interaction. An attacker can exploit this vulnerability by:

Crafting a malicious webpage containing specially designed web content that triggers the memory corruption
Delivering the malicious page to victims through phishing emails, malicious advertisements, or compromised legitimate websites
When the victim visits the page using Safari or any WebKit-based browser, the malicious content triggers the memory corruption
The attacker leverages the memory corruption to achieve arbitrary code execution on the victim's device

The exploitation chain typically involves heap grooming techniques to place controlled data in predictable memory locations, followed by triggering the memory corruption to overwrite critical control structures such as function pointers or vtables.

Detection Methods for CVE-2023-42917

Indicators of Compromise

Unexpected Safari or WebKit process crashes followed by suspicious system behavior
Anomalous network connections from WebKit processes to unknown external hosts
Unusual JavaScript execution patterns or excessive memory allocation in browser processes
Creation of unauthorized processes spawned from Safari or WebKit components

Detection Strategies

Monitor for WebKit process crashes that exhibit memory corruption signatures in crash logs
Implement web content filtering to block known malicious domains associated with WebKit exploits
Deploy endpoint detection solutions capable of identifying exploitation attempts against browser engines
Analyze browser process behavior for anomalous child process creation or suspicious memory access patterns

Monitoring Recommendations

Enable verbose logging for WebKit and Safari processes to capture potential exploitation attempts
Configure SIEM solutions to alert on patterns consistent with browser-based exploitation chains
Monitor for the installation of persistence mechanisms that may follow successful exploitation
Track software versions across the environment to identify unpatched systems vulnerable to CVE-2023-42917

How to Mitigate CVE-2023-42917

Immediate Actions Required

Update all Apple devices to the latest security patches immediately (iOS 17.1.2, iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2)
Update WebKitGTK+ packages on Linux distributions to patched versions
Prioritize patching for devices with internet-facing browser access due to confirmed active exploitation
Review and restrict browsing activities until patches can be applied to vulnerable systems

Patch Information

Apple has released security updates addressing this vulnerability across multiple platforms. Organizations should apply the following updates immediately:

iOS and iPadOS: Update to version 17.1.2 or later via Apple Support Document HT214031
macOS Sonoma: Update to version 14.1.2 or later via Apple Support Document HT214032
Safari: Update to version 17.1.2 or later via Apple Support Document HT214033

For Linux distributions, refer to:

Given the confirmed active exploitation and CISA KEV listing, organizations should treat patching as an emergency priority.

Workarounds

Consider using alternative non-WebKit browsers on macOS systems until patches can be applied
Implement strict content filtering at the network perimeter to block known malicious domains
Enable Lockdown Mode on iOS devices for users at heightened risk of targeted attacks
Restrict browsing to trusted sites only and avoid clicking links from unknown sources until patched

bash

# Check Safari version on macOS
/Applications/Safari.app/Contents/MacOS/Safari --version

# Check WebKitGTK version on Linux (Debian/Ubuntu)
dpkg -l | grep webkit2gtk

# Update WebKitGTK on Debian/Ubuntu
sudo apt update && sudo apt upgrade libwebkit2gtk-4.0-37