Apple iOS Kernel and RTKit Zero-Days CVE-2024-23225/23296

What to do

1. Pull an OS version report from your MDM and flag iPhones and iPads below iOS/iPadOS 17.4 (on 17) or 16.7.8 (on 16).
2. Check Macs with sw_vers -productVersion and flag Sonoma below 14.4, Ventura below 13.6.7 and Monterey below 12.7.6.
3. Update flagged devices to the newest build they support, and enforce a minimum OS version with a deadline in MDM.
4. Retire, or block from corporate access, any device that cannot reach those builds.
5. Turn on Lockdown Mode for high-risk users; Google says the Coruna kit quits when it detects Lockdown Mode.

How to check if you are affected or compromised

• Apple has published no indicators of compromise for these two CVEs.
• Search DNS and proxy logs for the Coruna delivery domains Google published, such as cdn[.]uacounter[.]com, ai-scorepredict[.]com, goodcryptocurrency[.]top and pepeairdrop01[.]com.
• If an old iOS device hit one of those domains, get a professional forensic review and treat crypto wallets, seed phrases and credentials on it as exposed.

What happened#

On March 5, 2024, Apple released iOS 17.4 and iPadOS 17.4 with fixes for two memory corruption bugs that it said "may have been exploited". CVE-2024-23225 is in the kernel. CVE-2024-23296 is in RTKit, which Help Net Security describes as Apple's embedded real-time operating system. The iOS 17.4 notes give both the same impact: "An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections." CISA added both to the KEV catalog on March 6, and NVD scores each 7.8. Neither is a way in: they help an attacker who already has kernel read/write defeat the protections that stop a kernel bug becoming full control.

In March 2026, Google's Coruna report mapped the two CVEs to page-protection bypasses codenamed "Sparrow" and "Rocket" in Coruna, a kit of 23 exploits for iOS 13 through 17.2.1. Google first saw the kit with a surveillance vendor's customer in February 2025. Next it appeared on compromised Ukrainian sites used by UNC6353, a suspected Russian espionage group. By late 2025, UNC6691, a financially motivated group operating from China, was serving it from fake finance and crypto sites to any iOS visitor. Google cautions that some of its CVE mappings may be revised.

Who is affected#

iOS 17.4 covers the iPhone XS and later. The iPhone 8 and X got the kernel fix in iOS 16.7.6 the same day, but the RTKit fix only in iOS 16.7.8 on May 13, 2024. macOS Sonoma 14.4 fixed both. Ventura and Monterey got the kernel fix in March and the RTKit fix later, in Ventura 13.6.7 and Monterey 12.7.6. watchOS 10.4, tvOS 17.4 and visionOS 1.1 fixed both.

Do you really need to act?#

Most fleets do not. Any device updated in the past two years is well past these fixes. Apple's current builds are iOS 27.0.1 and 26.7.1, plus iOS 18.7.10, iPadOS 17.7.11 and iOS 16.7.16 for older hardware. The exposure is the spare phone, kiosk iPad or test device left on an old iOS 16 or 17 build. Coruna raises the stakes for those devices: a financially motivated crew deployed it on mass scam sites, so these bugs are no longer limited to spyware operators.

What to do now#

1. Pull an OS version report from MDM and flag anything below iOS/iPadOS 17.4 (on 17) or 16.7.8 (on 16). For a USB-attached device, run ideviceinfo -k ProductVersion.
2. On Macs, run sw_vers -productVersion and flag Sonoma below 14.4, Ventura below 13.6.7 and Monterey below 12.7.6.
3. Update with sudo softwareupdate --install --all --restart on Macs, or Settings > General > Software Update on iPhone and iPad. Then enforce a minimum OS version with a deadline in MDM.
4. Retire devices that cannot reach those builds, or block them from corporate access.
5. Turn on Lockdown Mode for high-risk users. Google says Coruna quits when it detects it.

How to tell if you were hit#

Apple has published no indicators. Google lists Coruna delivery domains, including cdn[.]uacounter[.]com (UNC6353), ai-scorepredict[.]com, goodcryptocurrency[.]top and pepeairdrop01[.]com (UNC6691). Search DNS and proxy logs, for example grep -E "uacounter\.com|ai-scorepredict\.com|goodcryptocurrency\.top|pepeairdrop01\.com" dns.log. According to Google, the final payload injects into powerd as com.apple.assistd and hunts for crypto wallets and seed phrases. If an old device reached one of these domains, get a professional forensic review and treat the wallets and credentials on it as exposed. A clean search proves little.

Timeline#

• Mar 5, 2024 — Apple releases iOS 17.4 and iOS 16.7.6, and the CVEs are published.
• Mar 6, 2024 — CISA adds both CVEs to KEV, with a March 27 federal deadline.
• Mar 7, 2024 — Apple ships macOS Sonoma 14.4, Ventura 13.6.5, Monterey 12.7.4, watchOS 10.4, tvOS 17.4 and visionOS 1.1.
• May 13, 2024 — iOS 16.7.8 and Ventura 13.6.7 add the RTKit fix.
• Jul 29, 2024 — Monterey 12.7.6 adds the RTKit fix.
• Mar 3, 2026 — Google publishes its Coruna report naming both CVEs.

Vulnerability records

• CVE-2024-23225 · KEV 2024-03-06 · A memory corruption issue was addressed with improved validation.
• CVE-2024-23296 · KEV 2024-03-06 · A memory corruption issue was addressed with improved validation.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Apple — About the security content of iOS 17.4 and iPadOS 17.4 support.apple.com
2. Apple — About the security content of iOS 16.7.6 and iPadOS 16.7.6 support.apple.com
3. Apple — About the security content of iOS 16.7.8 and iPadOS 16.7.8 support.apple.com
4. Apple — About the security content of macOS Sonoma 14.4 support.apple.com
5. Apple — About the security content of macOS Ventura 13.6.7 support.apple.com
6. Apple — About the security content of macOS Monterey 12.7.6 support.apple.com
7. Apple — Apple security releases support.apple.com
8. CVE record — CVE-2024-23225 cve.org
9. CVE record — CVE-2024-23296 cve.org
10. NVD — CVE-2024-23225 nvd.nist.gov
11. NVD — CVE-2024-23296 nvd.nist.gov
12. CISA — Known Exploited Vulnerabilities: CVE-2024-23225 cisa.gov
13. CISA — Known Exploited Vulnerabilities: CVE-2024-23296 cisa.gov
14. Google Threat Intelligence Group — Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit cloud.google.com

Coverage and analysis

1. Help Net Security — Apple fixes two actively exploited iOS zero-days (CVE-2024-23225, CVE-2024-23296) helpnetsecurity.com