Apple Releases Emergency Updates to Address Zero-Days Exploited in Attacks
April 7, 2023
Apple has released emergency security updates to address two new zero-day vulnerabilities that have been actively exploited to compromise iPhones, Macs, and iPads. The company stated, "Apple is aware of a report that this issue may have been actively exploited." The issues were described in security advisories published on Friday.
The first security flaw, tracked as CVE-2023-28206, is an IOSurfaceAccelerator out-of-bounds write that could lead to data corruption, a crash, or code execution. Successful exploitation of this vulnerability allows attackers to use a maliciously crafted app to execute arbitrary code with kernel privileges on targeted devices.
The second zero-day, CVE-2023-28205, is a WebKit use after free weakness that allows data corruption or arbitrary code execution when reusing freed memory. This flaw can be exploited by tricking targets into loading malicious web pages under attackers' control, which could lead to code execution on compromised systems.
The two zero-day vulnerabilities were addressed in iOS 16.4.1, iPadOS 16.4.1, macOS Ventura 13.3.1, and Safari 16.4.1 with improved input validation and memory management. Apple has stated that the list of affected devices is quite extensive. Although the company is aware of in-the-wild exploitation reports, it has not yet published information regarding these attacks. However, it revealed that the two flaws had been reported by Clément Lecigne of Google's Threat Analysis Group and Donncha Ó Cearbhaill of Amnesty International's Security Lab. Both organizations regularly disclose campaigns exploiting zero-day bugs abused by government-sponsored threat actors to deploy commercial spyware on the smartphones and computers of politicians, journalists, dissidents, and other high-risk individuals worldwide.
Last week, Google TAG and Amnesty International exposed two recent series of attacks using exploit chains of Android, iOS, and Chrome zero-day and n-day flaws to deploy mercenary spyware. While the zero-days patched today were most likely only used in highly-targeted attacks, installing these emergency updates as soon as possible is highly recommended to block potential attack attempts.
In February, Apple addressed another WebKit zero-day, CVE-2023-23529, which was exploited in attacks to trigger OS crashes and gain code execution on vulnerable iPhones, iPads, and Macs.
Related News
- Apple Addresses Actively Exploited WebKit Zero-Day for Older iPhones and iPads
- CISA Adds Four Security Vulnerabilities to Known Exploited List
- Apple Patches Zero-Day Vulnerability Used in iPhone, iPad, and Mac Attacks
Latest News
- Critical Vulnerability in VM2 JavaScript Sandbox Library Exploitable
- Sophos Addresses Critical Code Execution Vulnerability in Web Security Appliance
- Twitter Vulnerability Leads to 'Shadow Ban' Exploits, Receives Official CVE
- 80,000 QNAP Devices Exposed to Cyberattacks Due to Zero-Day Vulnerabilities
- Lazarus Group Suspected in 3CX Breach as Second-Stage Backdoor Discovered
Like what you see?
Get a digest of headlines, vulnerabilities, risk context, and more delivered to your inbox.
