Apple fixes two actively exploited iOS zero-days (CVE-2024-23225, CVE-2024-23296)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-23225 +1 in the same advisory: …23296 | Memory Corruption Kernel Protection Bypass in Apple iOS, macOS, tvOS, visionOS CVE-2024-23225 is a memory-corruption flaw (CWE-787, out-of-bounds write) in the kernels of Apple's iOS, iPadOS, macOS, tvOS, visionOS and watchOS, addressed with improved memory validation in Apple's March 2024 updates. It is triggered locally (CVSS AV:L/PR:L/UI:N) after an attacker has already obtained arbitrary kernel read and write capability, typically as the final stage of an exploit chain, and requires no user interaction. Successful abuse lets the attacker bypass the kernel's memory protections, converting an existing kernel read/write primitive into deeper and more reliable system compromise. Affected users are those running iPhone/iPad software older than iOS/iPadOS 17.4 (or 16.7.6 on the iOS 16 line), Macs older than macOS Sonoma 14.4 / Ventura 13.6.5 / Monterey 12.7.4, Apple TV units older than tvOS 17.4, Apple Vision Pro units older than visionOS 1.1, and Apple Watch units older than watchOS 10.4. Apple has stated the issue may have been exploited in the wild, CISA added it to the KEV on 2024-03-06 as part of the March 2024 emergency update batch, and EPSS currently assigns a 1.5% probability of exploitation within 30 days (72nd percentile). Do: Patch immediately to iOS/iPadOS 17.4 (or 16.7.6 for devices that cannot run 17), macOS Sonoma 14.4 / Ventura 13.6.5 / Monterey 12.7.4, tvOS 17.4, visionOS 1.1 and watchOS 10.4; there is no known workaround, so updating is the only mitigation. Because the flaw is KEV-listed, federal agencies must apply the vendor fixes within the BOD 22-01 deadline, and all defenders should verify installed OS versions fleet-wide (e.g., via MDM) and prioritize internet-facing and high-risk users. | 7.8 | 1% | KEV |
| mass≈2 billion active Apple devices (combined installed base); virtually all devices on pre-March 2024 OS builds were affected at disclosure |
Full article361 words · extracted from helpnetsecurity.com · click to collapse
Apple has fixed two iOS zero-day vulnerabilities (CVE-2024-23225, CVE-2024-23296) exploited by attackers in the wild.
CVE-2024-23225 and CVE-2024-23296
On Tuesday, Apple released security updates for all three supported branches of iOS and iPadOS.
iOS and iPadOS 17.4 carry fixes for four vulnerabilities:
- Two affecting the privacy of users (allowing an app to read sensitive location information and making users’ locked tabs visible)
- CVE-2024-23225, a memory corruption issue in the OSes’ kernel that could allow attackers to bypass kernel memory protections
- CVE-2024-23296, a memory corruption issue in RTKit (Apple’s proprietary embedded/real-time operating system) that may also allow attackers to bypass kernel memory protections
CVE-2024-23225 has also been fixed in iOS/iPadOS 16.7.6. “Additional CVE entries [are] coming soon,” Apple noted for both updates.
The iOS/iPadOS 15.8.2 update has currently no associated CVEs.
While it’s usual for Apple to refrain from sharing any details about in-the-wild attacks leveraging their zero-days, they usually acknowledge the person/research team that reported them – but not this time.
The importance of patching
Zero-days in iOS are often exploited by mobile spyware makers to saddle targets with malware capable of extracting sensitive data from their iPhones and to spy on conversations.
This pricy spyware is used sparingly to compromise specific targets, so it isn’t something most users need to worry about.
Still, with Apple having been forced to allow third-party app stores for iOS apps in Europe, malicious apps occasionally lurking on its App Store, and threat actors increasingly developing and looking for malware able to run on iOS and macOS, regularly updating your Apple devices is definitely becoming even more important.
UPDATE (March 8, 2024, 04:50 a.m. ET):
On Thursday, Apple released updates for macOS, watchOS, tvOS, visionsOS and Safari.
The two zero-days (CVE-2024-23225, CVE-2024-23296) previously patched in iOS are also addressed in the updates for macOS Sonoma, watchOS, tvOS and visionOS, while Monterey and Ventura received a patch only for CVE-2024-23225.
The company urges users to update to the following versions:
- Safari 17.4
- macOS Sonoma 14.4
- macOS Ventura 13.6.5
- macOS Monterey 12.7.4
- watchOS 10.4
- tvOS 17.4
- visionOS 1.1
The company has also updated the list of vulnerabilities fixed in the iOS/iPadOS updates released on Tuesday.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/03/06/cve-2024-23225-cve-2024-23296/