Google Researchers Detail 5-Year-Old Apple Safari Vulnerability Exploited in the Wild

A security flaw in Apple Safari that was exploited in the wild previously this calendar year was at first preset in 2013 and reintroduced in December 2016, in accordance to a new report from Google Undertaking Zero.

The issue, tracked as CVE-2022-22620 (CVSS rating: 8.8), fears a circumstance of a use-immediately after-free vulnerability in the WebKit part that could be exploited by a piece of specifically crafted web information to gain arbitrary code execution.

In early February 2022, Apple delivered patches for the bug across Safari, iOS, iPadOS, and macOS, though acknowledging that it “may possibly have been actively exploited.”

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

“In this situation, the variant was completely patched when the vulnerability was in the beginning reported in 2013,” Maddie Stone of Google Project Zero mentioned. “However, the variant was reintroduced a few decades later on all through significant refactoring attempts. The vulnerability then ongoing to exist for 5 several years till it was fixed as an in-the-wild zero-day in January 2022.”

Though both of those the 2013 and 2022 bugs in the Record API are fundamentally the exact, the paths to induce the vulnerability are distinctive. Then subsequent code improvements undertaken a long time afterwards revived the zero-working day flaw from the lifeless like a “zombie.”

Stating the incident is not one of a kind to Safari, Stone further more pressured getting suitable time to audit code and patches to stay clear of instances of duplicating the fixes and knowledge the security impacts of the variations being carried out.

“Equally the October 2016 and the December 2016 commits were incredibly large. The commit in Oct transformed 40 data files with 900 additions and 1225 deletions. The commit in December improved 95 information with 1336 additions and 1325 deletions,” Stone noted.

“It seems untenable for any builders or reviewers to recognize the security implications of each modify in people commits in element, specially because they are connected to life time semantics.”

Discovered this article appealing? Observe THN on Fb, Twitter  and LinkedIn to browse extra distinctive written content we post.