Apple fixed new actively exploited CVE-2023-38606 zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-32435 +1 in the same advisory: …32434 | Memory Corruption in Apple WebKit (iOS, iPadOS, macOS, Safari) Enables Code Execution CVE-2023-32435 is an out-of-bounds write (CWE-787) memory corruption flaw in the WebKit engine shipped with Apple Safari, iOS, iPadOS, and macOS. It is triggered when WebKit processes maliciously crafted web content, such as a hostile webpage or embedded HTML, and successful exploitation leads to arbitrary code execution. Because WebKit is also used by non-Apple HTML parsers and applications, the impact extends beyond Safari and Apple's own browsers. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2023-06-23, confirming exploitation in the wild, though ransomware use is unknown and no public proof-of-concept is known. EPSS estimates a 22.8% probability of exploitation in the next 30 days (98th percentile), and a CVSS score is not yet published. Do: Update Safari to 16.5 or later, iOS/iPadOS to 16.5 (or 15.7.6 on the legacy branch) or later, and macOS to the patched Ventura/Monterey/Big Sur releases (13.4 / 12.6.6 / 11.7.7) or later, then verify managed fleets are on fixed builds per the CISA KEV required action. Prioritize internet-exposed and high-risk users, since the flaw is confirmed exploited in the wild. If you ship or operate non-Apple products that embed WebKit, pull the fixed WebKit from the upstream project or your vendor. | 8.8 group max | 23% | KEV |
| mass>1,000,000,000 devices/users (WebKit is the system HTML engine on every iPhone and iPad and powers Safari on macOS) | |
| CVE-2023-37450 +1 in the same advisory: …38606 | Arbitrary Code Execution in Apple WebKit (iOS, iPadOS, macOS, Safari, tvOS, watchOS) CVE-2023-37450 is a high-severity (CVSS 8.8) arbitrary code execution vulnerability in Apple's WebKit browser engine, affecting iOS, iPadOS, Safari, macOS Ventura, tvOS, watchOS, and WebKitGTK. It is triggered when an affected device processes maliciously crafted web content — for example, when a user is lured into visiting an attacker-controlled webpage (user interaction is required, hence the UI:R CVSS vector). Successful exploitation grants the attacker arbitrary code execution within the web-content/browser context, the typical entry point for full iPhone, iPad, or Mac compromise chains. Anyone running iPhone OS/iPadOS earlier than 16.6, Safari earlier than 16.5.2, macOS Ventura earlier than 13.5, tvOS earlier than 16.6, watchOS earlier than 9.6, or unpatched WebKitGTK builds is affected. Apple reports the issue may have been actively exploited before it was patched, CISA added it to the KEV catalog on 2023-07-13, and EPSS assigns an 18.9% probability (97th percentile) of exploitation over the next 30 days. Do: Upgrade immediately to iOS 16.6 / iPadOS 16.6, Safari 16.5.2, macOS Ventura 13.5, tvOS 16.6, and watchOS 9.6, or apply the latest available patch for older OS branches on devices that cannot take the 16.x/Ventura updates; this is a CISA KEV entry with a federal remediation requirement. Because exploitation occurs through normal web browsing, patching is the only reliable mitigation — avoid untrusted websites as an interim measure. WebKitGTK users should update to the latest patched WebKitGTK release and verify that dependent applications have been rebuilt against the fixed library. | 8.8 group max | 19% | KEV |
| mass≈2 billion active Apple devices (WebKit is the web engine for iOS/iPadOS, Safari, tvOS and watchOS); no public counts of exploited devices are known |
Full article644 words · extracted from securityaffairs.com · click to collapse
Apple released security updates to address an actively exploited zero-day flaw in iOS, iPadOS, macOS, tvOS, watchOS, and Safari.
Apple released urgent security updates to address multiple flaws in iOS, iPadOS, macOS, tvOS, watchOS, and Safari, including an actively exploited zero-day.
The vulnerability, tracked as CVE-2023-38606, resides in the kernel and can be exploited to modify sensitive kernel state potentially. The company addressed the vulnerability with improved state management.
“An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1” reads the advisory published by Apple.
The vulnerability CVE-2023-38606 is one of the flaws exploited by the threat actors in the Operation Triangulation.
In early June, researchers from the Russian firm Kaspersky uncovered a previously unknown APT group that is targeting iOS devices with zero-click exploits as part of a long-running campaign dubbed Operation Triangulation.
The experts discovered the attack while monitoring the network traffic of their own corporate Wi-Fi network dedicated to mobile devices using the Kaspersky Unified Monitoring and Analysis Platform (KUMA).
According to Kaspersky researchers, Operation Triangulation began at least in 2019 and is still ongoing.
The attack chains commenced with a message sent via the iMessage service to an iOS device. The message has an attachment containing an exploit. The expert explained that the message triggers a remote code execution vulnerability without any user interaction (zero-click).
Shortly after Kaspersky’s disclosure, Russia’s FSB accused the US intelligence for the attacks against the iPhones. According to Russian intelligence, thousands of iOS devices belonging to domestic subscribers and diplomatic missions and embassies have been targeted as part of Operation Triangulation.
The operations aimed at gathering intelligence from diplomats from NATO countries, Israel, China and Syria.
FSB believes that Apple supported US intelligence in this cyberespionage campaign.
Other zero-day flaws exploited during the operation are CVE-2023-32434 and CVE-2023-32435, which were both addressed by Apple in June.
Apple released the following updates:
| Name and information link | Available for | Release date |
|---|---|---|
| Safari 16.6 | macOS Big Sur and macOS Monterey | 24 Jul 2023 |
| iOS 16.6 and iPadOS 16.6 | iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later | 24 Jul 2023 |
| iOS 15.7.8 and iPadOS 15.7.8 | iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch (7th generation) | 24 Jul 2023 |
| macOS Ventura 13.5 | macOS Ventura | 24 Jul 2023 |
| macOS Monterey 12.6.8 | macOS Monterey | 24 Jul 2023 |
| macOS Big Sur 11.7.9 | macOS Big Sur | 24 Jul 2023 |
| tvOS 16.6 | Apple TV 4K (all models) and Apple TV HD | 24 Jul 2023 |
| watchOS 9.6 | Apple Watch Series 4 and later | 24 Jul 2023 |
Recently Apple has re-released its Rapid Security Response updates to address the CVE-2023-37450 flaw in iOS and macOS after fixing browsing issues on certain websites caused by the first RSR issued by the company.
On July 10, Apple released Rapid Security Response updates for iOS, iPadOS, macOS, and Safari web browser to address the zero-day flaw that has been actively exploited in the wild.
Tricking the victim into processing specially crafted web content may lead to arbitrary code execution.
The flaw resides in the WebKit and Apple addressed it by improving checks.
“Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.” reads the advisory published by Apple.
The vulnerability CVE-2023-37450 was reported to the company by an anonymous researcher.
The IT giant did not reveal details about the attacks in the wild exploiting this issue or the nature of the threat actors.
Follow me on Twitter: @securityaffairs Facebook and Mastodon
(SecurityAffairs – hacking, zero-day)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/148786/hacking/cve-2023-38606-zero-day-apple.html