CISA Warns of Active Exploitation of Critical Vulnerability in iOS, iPadOS, and macOS

The U.S. Cybersecurity and Infrastructure Security Company (CISA) on Wednesday added a large-severity flaw impacting iOS, iPadOS, macOS, tvOS, and watchOS to its Identified Exploited Vulnerabilities (KEV) catalog, based on evidence of lively exploitation.

The vulnerability, tracked as CVE-2022-48618 (CVSS rating: 7.8), issues a bug in the kernel part.

“An attacker with arbitrary browse and generate functionality could be in a position to bypass Pointer Authentication,” Apple claimed in an advisory, including the issue “might have been exploited towards versions of iOS launched just before iOS 15.7.1.”

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The iPhone maker explained the problem was addressed with enhanced checks. It really is at the moment not known how the vulnerability is currently being weaponized in genuine-earth attacks.

Interestingly, patches for the flaw have been introduced on December 13, 2022 with the release of iOS 16.2, iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, and watchOS 9.2, while it was only publicly disclosed more than a 12 months later on on January 9, 2024.

It truly is well worth noting that Apple did solve a related flaw in the kernel (CVE-2022-32844, CVSS rating: 6.3) in iOS 15.6 and iPadOS 15.6, which was transported on July 20, 2022.

“An app with arbitrary kernel examine and compose capability may possibly be equipped to bypass Pointer Authentication,” the business mentioned at the time. “A logic issue was dealt with with enhanced state management.”

In light-weight of the energetic exploitation of CVE-2022-48618, CISA is recommending that Federal Civilian Govt Department (FCEB) organizations apply the fixes by February 21, 2024.

The growth also will come as Apple expanded patches for an actively exploited security flaw in the WebKit browser engine (CVE-2024-23222, CVSS score: 8.8) to include things like its Apple Eyesight Pro headset. The deal with is readily available in visionOS 1..2.

Observed this posting intriguing? Adhere to us on Twitter  and LinkedIn to read through more exclusive content material we post.