Apple has released security updates to fix two zero-day vulnerabilities, one publicly disclosed and the other exploited in the wild by attackers to hack iPhones and Macs.
The first zero-day patch today (tracked as CVE-2022-22587) [1, 2] is a memory corruption bug in IOMobileFrameBuffer that affects iOS, iPadOS, and macOS Monterey.
Successful exploitation of this bug leads to the execution of arbitrary code with kernel privileges on compromised devices.
“Apple is aware of a report that this issue may have been actively exploited,” Apple said when describing the zero-day bug.
The full list of affected devices includes:
- iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
- and macOS Monterey
The bug was found by an anonymous researcher, Meysam Firouzi (@R00tkitSMM) of MBition – Mercedes-Benz Innovation Lab, and Siddharth Aeri (@b1n4r1b01).
Firouzi and Aeri told BleepingComputer that they both found the bug independently and were unaware that threat actors were exploiting it in the wild.
Second Day Zero is a Safari WebKit bug in iOS and iPadOS that allowed websites to track your browsing activity and user identities in real time.
The bug was first disclosed to Apple by Martin Bajanik of FingerprintJS on November 28, 2021 and publicly disclosed on January 14, 2022. After the researcher disclosed the bug, it was assigned CVE-2022-22594 and fixed in iOS 15.3 and iPadOS 15.3 Security Update.
These bugs are the first zero-day vulnerabilities patched by Apple in 2022.
However, Apple patched what looked like an endless stream of zero-day bugs in 2021 that were used in attacks against iOS and macOS devices.
These bugs included numerous zero-day vulnerabilities used to install Pegasus spyware on the iPhones of journalists, activists and politicians.
