CVE-2023-42919: Apple iPadOS Information Disclosure Flaw

CVE-2023-42919 Overview

CVE-2023-42919 is a privacy vulnerability affecting multiple Apple operating systems. The issue stems from insufficient redaction of private data in log entries, allowing a local application to read sensitive user information that should have been masked. Apple addressed the flaw by improving private data redaction in system logging routines.

The vulnerability impacts macOS Sonoma, macOS Ventura, macOS Monterey, iOS, iPadOS, and watchOS. Successful exploitation requires local code execution context and user interaction, but no elevated privileges. The flaw is categorized as an information disclosure issue ([NVD-CWE-noinfo]).

Critical Impact
An app running on an affected device may read sensitive user data exposed through unredacted system log entries, undermining Apple's logging privacy model.

Affected Products

Apple macOS Sonoma prior to 14.2, Ventura prior to 13.6.3, and Monterey prior to 12.7.2
Apple iOS prior to 17.2 and iOS prior to 16.7.3, plus iPadOS 17.2 and iPadOS 16.7.3
Apple watchOS prior to 10.2

Discovery Timeline

2023-12-12 - CVE-2023-42919 published to NVD
2025-11-04 - Last updated in NVD database

Technical Details for CVE-2023-42919

Vulnerability Analysis

The flaw is an information disclosure issue in Apple's system logging subsystem. Apple's unified logging framework supports a privacy classification model that marks specific log arguments as private, replacing their values with <private> placeholders unless a privileged debugger attaches. CVE-2023-42919 indicates that one or more log call sites failed to apply this redaction, leaking sensitive user data into log entries readable by local processes.

An application installed on the device can read these entries through standard log access APIs. The exposed data may include identifiers, paths, or other sensitive material that the privacy model was meant to mask. The vulnerability does not provide code execution or integrity impact; the risk is confined to confidentiality of user data.

Apple addressed the issue by improving private data redaction for the affected log entries across macOS Sonoma 14.2, macOS Ventura 13.6.3, macOS Monterey 12.7.2, iOS and iPadOS 17.2, iOS and iPadOS 16.7.3, and watchOS 10.2.

Root Cause

The root cause is incorrect privacy annotation or missing redaction logic on selected log format specifiers. When sensitive arguments were emitted to the unified log, they bypassed the private qualifier and were written in plaintext, making them retrievable by any local consumer of the log stream.

Attack Vector

Exploitation requires a local attacker with the ability to run code on the device, typically through an installed application, and user interaction sufficient to trigger the vulnerable code path. The attacker reads the unified log, parses entries that should contain redacted markers, and extracts the unredacted sensitive values. Remote exploitation is not possible.

No public proof-of-concept code, exploit module, or CISA KEV listing exists for CVE-2023-42919. The EPSS probability is 0.027%, indicating very low observed exploitation activity.

Detection Methods for CVE-2023-42919

Indicators of Compromise

Installed applications enumerating or streaming the unified log via OSLogStore, log show, or related APIs without a clear operational need
Log entries on unpatched systems containing sensitive identifiers in plaintext where <private> redaction is expected
Mobile or macOS apps reading log archives outside their own subsystem scope

Detection Strategies

Inventory installed macOS, iOS, iPadOS, and watchOS builds and flag versions below the fixed releases listed in Apple advisories HT214034 through HT214041
Monitor endpoint telemetry for processes invoking log inspection APIs, then correlate with application reputation and entitlements
Review MDM compliance reports to identify devices that have not received the December 2023 security updates

Monitoring Recommendations

Alert on macOS processes that spawn log or osascript to harvest unified log content from non-administrative contexts
Track third-party app installations on managed devices and validate their need for diagnostic log access
Audit developer and enterprise-signed apps that request com.apple.developer.os-log or similar diagnostic entitlements

How to Mitigate CVE-2023-42919

Immediate Actions Required

Update Apple devices to macOS Sonoma 14.2, macOS Ventura 13.6.3, macOS Monterey 12.7.2, iOS 17.2 or 16.7.3, iPadOS 17.2 or 16.7.3, and watchOS 10.2 or later
Enforce minimum OS version policies through MDM to block enrollment of vulnerable builds
Restrict installation of untrusted applications that request log or diagnostics entitlements

Patch Information

Apple released coordinated fixes on December 11, 2023. Refer to the vendor advisories for build-specific details: Apple Support HT214034, HT214035, HT214036, HT214037, HT214038, and HT214041.

Workarounds

No vendor-supplied workaround exists; applying the security update is the only supported remediation
Limit installation of third-party applications on shared or high-value devices until patches are deployed
Use MDM configuration profiles to block sideloaded or enterprise-signed apps that are not explicitly approved

bash

# Verify installed macOS build and confirm it meets the patched version
sw_vers
softwareupdate --list
sudo softwareupdate --install --all --restart