Apple Patches Two Zero-Days Exploited in the Wild

Apple introduced updates for two zero-working day vulnerabilities that had been utilized to attack iPhone, iPad and Mac gadgets.

“Apple is aware of a report that [these issues] could have been actively exploited,” the tech big wrote in a security advisory published previous Friday.

The initially patched flaw (CVE-2023-28206) is an IOSurfaceAccelerator out-of-bounds write issue, most likely enabling an application to execute arbitrary code with kernel privileges. Apple stated the issue was dealt with with enhanced input validation. 

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

“The IOSurfaceAccelerator framework is utilized by quite a few iOS and MacOS apps that need higher-overall performance graphics processing, these as video editors, games and augmented actuality programs,” explained Krishna Vishnubhotla, vice president of product approach at Zimperium.

“Since IOSurfaceAccelerator gives very low-degree obtain to graphics hardware means, exploiting a vulnerability in the framework could give an attacker the potential to manipulate graphics assets, intercept or modify knowledge, or even lead to the system to crash.”

The next vulnerability (CVE-2023-28205) is a WebKit use-following-no cost flaw that permits data corruption or arbitrary code execution when reusing freed memory. Apple stated it fastened the bug with enhanced memory administration.

“WebKit is a main software package element of macOS and iOS, dependable for rendering web internet pages and executing JavaScript code in the Safari web browser and other apps that use WebKit,” said Vishnubhotla.

“Exploiting a vulnerability in WebKit could make it possible for attackers to just take management of the device’s web browsing abilities and steal delicate consumer information, these types of as login credentials and other particular information. It could also permit attackers to inject destructive code into web internet pages or start phishing attacks to trick customers into revealing sensitive info.”

Examine far more on Apple zero-days in this article: Apple Fixes Actively Exploited iPhone Zero-Working day Vulnerability

Both equally vulnerabilities affect macOS Ventura 13.3.1 and iOS and iPadOS 16.4.1 units. Apple credited Clément Lecigne of Google’s Risk Analysis Group and Donncha Ó Cearbhaill of Amnesty International’s Security Lab for their discovery.

“Apple is responding immediately in this article, which is fantastic, in particular with proof that these vulnerabilities are currently being exploited in the wild,” commented Mike Parkin, Senior Complex Engineer at Vulcan Cyber.

“It is intriguing that Amnesty International’s Security Lab was a person of the companies included in acquiring and reporting the issue. Though Apple hasn’t reported substantially about the exploits, it seems likely, offered the reporting and previously background, that the exploits were being deployed by condition-degree risk actors.”

The Apple advisory arrives times just after Google warned Android customers of commercial adware suppliers exploiting zero-working day flaws on mobile devices.

Editorial picture credit score: Omar Tursic / Shutterstock.com