---
title: "Apple iOS Kernel and RTKit Zero-Days CVE-2024-23225/23296"
url: https://erroneo.us/security/briefs/apple-ios-kernel-rtkit-zero-days-cve-2024-23225-23296/
description: "Kernel and RTKit bugs exploited in March 2024 and later found in the Coruna iOS kit. Fixed in iOS 17.4, 16.7.8 and macOS 14.4. Find devices left behind."
type: security-brief
section: "Security Digest"
date_published: 2024-03-05
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-23225", "CVE-2024-23296"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Apple iOS Kernel and RTKit Zero-Days CVE-2024-23225/23296

**Verdict: Check exposure.** Fixed for two and a half years and long since installed on most devices, but any iPhone or iPad still on an old iOS 16 or 17 build is exposed to a kit that criminals have served from mass scam sites.

- **Who must act:** Anyone with iPhones or iPads on iOS 17 below 17.4 or iOS 16 below 16.7.8, or Macs on Sonoma below 14.4, Ventura below 13.6.7 or Monterey below 12.7.6, such as spare, kiosk, test or update-deferred devices.
- **Who can relax:** Fleets where every device runs a current Apple release (iOS 26.7.1 or 27.x, or the 18.7.10, 17.7.11 and 16.7.16 builds for older hardware), which are years past both fixes.
- **Affected:** iOS and iPadOS 17 before 17.4; iOS and iPadOS 16 before 16.7.6 (CVE-2024-23225) and before 16.7.8 (CVE-2024-23296); macOS Sonoma before 14.4; macOS Ventura before 13.6.5 (CVE-2024-23225) and before 13.6.7 (CVE-2024-23296); macOS Monterey before 12.7.4 (CVE-2024-23225) and before 12.7.6 (CVE-2024-23296); watchOS before 10.4, tvOS before 17.4, visionOS before 1.1
- **Fixed:** iOS and iPadOS 17.4; iOS and iPadOS 16.7.8 (16.7.6 fixed only CVE-2024-23225); macOS Sonoma 14.4; macOS Ventura 13.6.7; macOS Monterey 12.7.6; watchOS 10.4, tvOS 17.4, visionOS 1.1
- **CVEs:** CVE-2024-23225, CVE-2024-23296
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Pull an OS version report from your MDM and flag iPhones and iPads below iOS/iPadOS 17.4 (on 17) or 16.7.8 (on 16).
2. Check Macs with sw_vers -productVersion and flag Sonoma below 14.4, Ventura below 13.6.7 and Monterey below 12.7.6.
3. Update flagged devices to the newest build they support, and enforce a minimum OS version with a deadline in MDM.
4. Retire, or block from corporate access, any device that cannot reach those builds.
5. Turn on Lockdown Mode for high-risk users; Google says the Coruna kit quits when it detects Lockdown Mode.

### How to check if you are affected

- Apple has published no indicators of compromise for these two CVEs.
- Search DNS and proxy logs for the Coruna delivery domains Google published, such as cdn[.]uacounter[.]com, ai-scorepredict[.]com, goodcryptocurrency[.]top and pepeairdrop01[.]com.
- If an old iOS device hit one of those domains, get a professional forensic review and treat crypto wallets, seed phrases and credentials on it as exposed.

## What happened

On March 5, 2024, Apple released iOS 17.4 and iPadOS 17.4 with fixes for two memory corruption bugs that it said "may have been exploited". [CVE-2024-23225](https://www.cve.org/CVERecord?id=CVE-2024-23225) is in the kernel. [CVE-2024-23296](https://www.cve.org/CVERecord?id=CVE-2024-23296) is in RTKit, which [Help Net Security](https://www.helpnetsecurity.com/2024/03/06/cve-2024-23225-cve-2024-23296/) describes as Apple's embedded real-time operating system. The [iOS 17.4 notes](https://support.apple.com/en-us/120893) give both the same impact: "An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections." CISA added both to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23225) on March 6, and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-23225) scores each 7.8. Neither is a way in: they help an attacker who already has kernel read/write defeat the protections that stop a kernel bug becoming full control.

In March 2026, Google's [Coruna report](https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit) mapped the two CVEs to page-protection bypasses codenamed "Sparrow" and "Rocket" in Coruna, a kit of 23 exploits for iOS 13 through 17.2.1. Google first saw the kit with a surveillance vendor's customer in February 2025. Next it appeared on compromised Ukrainian sites used by UNC6353, a suspected Russian espionage group. By late 2025, UNC6691, a financially motivated group operating from China, was serving it from fake finance and crypto sites to any iOS visitor. Google cautions that some of its CVE mappings may be revised.

## Who is affected

iOS 17.4 covers the iPhone XS and later. The iPhone 8 and X got the kernel fix in [iOS 16.7.6](https://support.apple.com/en-us/120880) the same day, but the RTKit fix only in [iOS 16.7.8](https://support.apple.com/en-us/120898) on May 13, 2024. [macOS Sonoma 14.4](https://support.apple.com/en-us/120895) fixed both. Ventura and Monterey got the kernel fix in March and the RTKit fix later, in [Ventura 13.6.7](https://support.apple.com/en-us/120900) and [Monterey 12.7.6](https://support.apple.com/en-us/120910). watchOS 10.4, tvOS 17.4 and visionOS 1.1 fixed both.

## Do you really need to act?

Most fleets do not. Any device updated in the past two years is well past these fixes. [Apple's current builds](https://support.apple.com/en-us/100100) are iOS 27.0.1 and 26.7.1, plus iOS 18.7.10, iPadOS 17.7.11 and iOS 16.7.16 for older hardware. The exposure is the spare phone, kiosk iPad or test device left on an old iOS 16 or 17 build. Coruna raises the stakes for those devices: a financially motivated crew deployed it on mass scam sites, so these bugs are no longer limited to spyware operators.

## What to do now

1. Pull an OS version report from MDM and flag anything below iOS/iPadOS 17.4 (on 17) or 16.7.8 (on 16). For a USB-attached device, run `ideviceinfo -k ProductVersion`.
2. On Macs, run `sw_vers -productVersion` and flag Sonoma below 14.4, Ventura below 13.6.7 and Monterey below 12.7.6.
3. Update with `sudo softwareupdate --install --all --restart` on Macs, or Settings > General > Software Update on iPhone and iPad. Then enforce a minimum OS version with a deadline in MDM.
4. Retire devices that cannot reach those builds, or block them from corporate access.
5. Turn on Lockdown Mode for high-risk users. Google says Coruna quits when it detects it.

## How to tell if you were hit

Apple has published no indicators. Google lists Coruna delivery domains, including `cdn[.]uacounter[.]com` (UNC6353), `ai-scorepredict[.]com`, `goodcryptocurrency[.]top` and `pepeairdrop01[.]com` (UNC6691). Search DNS and proxy logs, for example `grep -E "uacounter\.com|ai-scorepredict\.com|goodcryptocurrency\.top|pepeairdrop01\.com" dns.log`. According to Google, the final payload injects into `powerd` as `com.apple.assistd` and hunts for crypto wallets and seed phrases. If an old device reached one of these domains, get a professional forensic review and treat the wallets and credentials on it as exposed. A clean search proves little.

## Timeline

- Mar 5, 2024 — Apple releases iOS 17.4 and iOS 16.7.6, and the CVEs are published.
- Mar 6, 2024 — CISA adds both CVEs to KEV, with a March 27 federal deadline.
- Mar 7, 2024 — Apple ships macOS Sonoma 14.4, Ventura 13.6.5, Monterey 12.7.4, watchOS 10.4, tvOS 17.4 and visionOS 1.1.
- May 13, 2024 — iOS 16.7.8 and Ventura 13.6.7 add the RTKit fix.
- Jul 29, 2024 — Monterey 12.7.6 adds the RTKit fix.
- Mar 3, 2026 — Google publishes its Coruna report naming both CVEs.

## Sources

1. [Apple — About the security content of iOS 17.4 and iPadOS 17.4](https://support.apple.com/en-us/120893)
2. [Apple — About the security content of iOS 16.7.6 and iPadOS 16.7.6](https://support.apple.com/en-us/120880)
3. [Apple — About the security content of iOS 16.7.8 and iPadOS 16.7.8](https://support.apple.com/en-us/120898)
4. [Apple — About the security content of macOS Sonoma 14.4](https://support.apple.com/en-us/120895)
5. [Apple — About the security content of macOS Ventura 13.6.7](https://support.apple.com/en-us/120900)
6. [Apple — About the security content of macOS Monterey 12.7.6](https://support.apple.com/en-us/120910)
7. [Apple — Apple security releases](https://support.apple.com/en-us/100100)
8. [CVE record — CVE-2024-23225](https://www.cve.org/CVERecord?id=CVE-2024-23225)
9. [CVE record — CVE-2024-23296](https://www.cve.org/CVERecord?id=CVE-2024-23296)
10. [NVD — CVE-2024-23225](https://nvd.nist.gov/vuln/detail/CVE-2024-23225)
11. [NVD — CVE-2024-23296](https://nvd.nist.gov/vuln/detail/CVE-2024-23296)
12. [CISA — Known Exploited Vulnerabilities: CVE-2024-23225](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23225)
13. [CISA — Known Exploited Vulnerabilities: CVE-2024-23296](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23296)
14. [Google Threat Intelligence Group — Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit](https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit)
15. [Help Net Security — Apple fixes two actively exploited iOS zero-days (CVE-2024-23225, CVE-2024-23296)](https://www.helpnetsecurity.com/2024/03/06/cve-2024-23225-cve-2024-23296/)

---
Source page: https://erroneo.us/security/briefs/apple-ios-kernel-rtkit-zero-days-cve-2024-23225-23296/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt