Apple has released security updates to patch two zero-day vulnerabilities, with one publicly disclosed and the other exploited in the wild by attackers to hack into iPhones and Macs.
The first zero-day patched today (tracked as CVE-2022-22587) [1, 2] is a memory corruption bug in the IOMobileFrameBuffer that affects iOS, iPadOS, and macOS Monterey.
Successful exploitation of this bug leads to arbitrary code execution with kernel privileges on compromised devices.
“Apple is aware of a report that this issue may have been actively exploited,” Apple said when describing the zero-day bug.
The complete list of impacted devices includes:
- iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
- and macOS Monterey
The bug was found by an anonymous researcher, Meysam Firouzi (@R00tkitSMM) of MBition – Mercedes-Benz Innovation Lab, and Siddharth Aeri (@b1n4r1b01).
The second zero-day is a Safari WebKit bug in iOS and iPadOS that allowed websites to track your browsing activity and users’ identities in real-time.
The bug was first disclosed to Apple by Martin Bajanik of FingerprintJS on November 28th, 2021, and publicly disclosed on January 14th, 2022. After the researcher disclosed the bug, it was assigned the CVE-2022-22594 and fixed in today’s iOS 15.3 and iPadOS 15.3 security update.
These bugs are the first zero-day vulnerabilities fixed by Apple in 2022.
However, Apple fixed what felt like a never-ending stream of zero-day bugs in 2021 that were used in attacks against iOS and macOS devices.
These bugs included vulnerabilities used to install the Pegasus spyware on the iPhones of journalists, activists, and politicians.
You may also enjoy reading, The largest DDoS to date, Microsoft mitigates a 3.47 Tbps DDoS attack
Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for RiSec Weekly Cybersecurity Newsletter Today
Remember, CyberSecurity Starts With You!
- Globally, 30,000 websites are hacked daily.
- 64% of companies worldwide have experienced at least one form of a cyber attack.
- There were 20M breached records in March 2021.
- In 2020, ransomware cases grew by 150%.
- Email is responsible for around 94% of all malware.
- Every 39 seconds, there is a new attack somewhere on the web.
- An average of around 24,000 malicious mobile apps are blocked daily on the internet.
