CISA added 2 more security flaws to its Known Exploited Vulnerabilities Catalog

CVE-2022-32917 is an out-of-bounds write (CWE-787) in the Apple operating system kernel that the vendor fixed with improved bounds checks. A local application running on a vulnerable device can trigger the flaw to execute arbitrary code with kernel privileges, giving an attacker full control of the device; the local (AV:L) attack vector means the attacker must already be able to run code on the device, such as through a malicious app, rather than reaching the flaw over the network. Users of Apple devices running iOS, iPadOS, or macOS versions earlier than the fixed releases are affected. Apple reported that the issue may have been actively exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-09-14 with no public proof-of-concept known.

Do: Update affected devices without delay to iOS 16 or iOS 15.7, iPadOS 15.7, macOS Monterey 12.6, or macOS Big Sur 11.7 (or any later release). Inventory Apple endpoints for outdated OS versions and prioritize patching because the flaw is on CISA's KEV catalog and was reported actively exploited. Since exploitation requires already running code on the device, review installed apps and treat the flaw as exploitable when chained with other local or app-delivery attack vectors.

The Windows Common Log File System (CLFS) driver contains an input-validation flaw (CWE-20) that leads to an out-of-bounds write (CWE-787), allowing an attacker who already has a foothold or local access on a system to escalate privileges. It is triggered when the driver processes malformed or specially crafted common log file data, rather than via a remote network request on its own. Successful exploitation yields elevated (typically SYSTEM-level) privileges, giving the attacker full control of the host and making the bug a common post-exploitation link in ransomware chains. CISA lists the affected product broadly as 'Microsoft Windows', so essentially all Windows installations current at the time of disclosure were in scope. The flaw is confirmed exploited in the wild: CISA added it to the KEV catalog on 2022-09-14 with known ransomware use, EPSS puts 30-day exploitation probability at 28.3% (98th percentile), and no public PoC is known.

Do: Apply Microsoft's September 2022 (or later) cumulative updates to every Windows host per vendor instructions, prioritizing endpoints and servers exposed for user or remote access. Because this is a local privilege escalation, treat it as a post-exploitation risk: also harden and patch initial-access surfaces (RDP, VPN, other exposed services) and hunt for signs of compromise such as unexpected SYSTEM-spawned processes or anomalous activity involving clfs.sys. Ransomware operators are known to use this bug, so remediation should be treated as urgent.