Two Critical Vulnerabilities Patched by Apple

Apple Patches Two Actively Exploited Zero-Day Vulnerabilities on iOS, iPadOS, and macOS

Apple's latest security updates for iOS, iPadOS, and macOS on Wednesday have tackled two critical zero-day vulnerabilities, CVE-2022-32893 and CVE-2022-32894. These vulnerabilities allowed attackers to execute arbitrary code on Apple devices, potentially granting them full control. Given that these vulnerabilities were actively exploited, it is essential for Apple device users to install the updates immediately to mitigate risks.

What Are Zero-Day Vulnerabilities, and Why Are They a Big Deal?

Zero-day vulnerabilities are security flaws that are unknown to the vendor and the public when attackers discover them, meaning there’s "zero" time for companies to prepare fixes. Once they’re identified, companies like Apple work quickly to develop patches before attackers have the chance to use them in more widespread attacks.

Apple’s proactive approach to patching these vulnerabilities reinforces its commitment to application security and user safety, and it’s crucial that users respond by installing these updates promptly.

Details of the Patched Zero-Day Vulnerabilities

CVE-2022-32893: WebKit Issue Leading to Arbitrary Code Execution

CVE-2022-32893 is a WebKit vulnerability that could allow attackers to execute arbitrary code on the target device by having it process specially crafted web content. WebKit is the underlying engine that powers Safari, and a compromise here can directly affect browser security and data integrity on Apple devices. By manipulating this vulnerability, attackers can run unauthorized code on a device, which can lead to device takeovers, data theft, or further malware installation.

Apple fixed this issue by improving boundary checks within the WebKit engine, enhancing application security on iOS, iPadOS, and macOS devices. This vulnerability highlights the importance of boundary specification in application design, which limits what content can interact with sensitive system areas.

CVE-2022-32894: Core OS Vulnerability Allowing Kernel Privilege Escalation

The CVE-2022-32894 vulnerability is a flaw in Apple’s OS kernel, allowing attackers to execute malicious code with high privileges. The kernel is the core part of the operating system, responsible for controlling hardware interactions and enforcing security protocols. This means that if an attacker gains kernel-level access, they could potentially control all aspects of the device, from network functions to sensitive data.

To mitigate this, Apple addressed the privilege escalation potential within the kernel by adding more rigorous verification and control measures. In doing so, Apple has closed off an attack vector that allowed malicious software to reach deeper levels of the device's operating system.

Why Regular Updates Are Crucial for Apple Users

With the patching of these two vulnerabilities, the total number of zero-day vulnerabilities patched by Apple this year has risen to six. The other four zero-days addressed in 2022 include:

• CVE-2022-22587: IOMobileFrameBuffer issue allowing attackers to escalate privileges.
• CVE-2022-22620: WebKit vulnerability that permitted arbitrary code execution.
• CVE-2022-22674: A graphic driver flaw affecting Intel graphics that could expose sensitive memory data.
• CVE-2022-22675: AppleAVD vulnerability that allowed unauthorized code execution.

This pattern of vulnerabilities highlights how frequently attackers exploit flaws before they are publicly known, reinforcing the need for regular, proactive updates.

How to Update Your Apple Devices

Updating Apple devices is simple and should be a priority for all users. Here’s how to do it:

1. For iOS and iPadOS: Go to Settings > General > Software Update and tap Download and Install.
2. For macOS: Go to System Preferences > Software Update and select Update Now.

Recommendations for IT and Security Teams

If you manage multiple Apple devices in a professional setting, here’s what you should prioritize:

1. Deploy updates across all managed devices: Use your Mobile Device Management (MDM) tools to push updates to all iOS, iPadOS, and macOS devices immediately. This reduces the window of vulnerability and ensures compliance.
2. Encourage security awareness training: Regularly train employees to recognize suspicious web content and phishing tactics, which are commonly used to exploit WebKit vulnerabilities. Keepnet Labs offers a Phishing Simulator to provide hands-on practice for recognizing these attacks.
3. Use human risk management strategies: The Keepnet Human Risk Management Platform enables organizations to measure and mitigate risk across users, minimizing the chance of human errors that could lead to device compromise.

Staying Ahead of the Curve: Apple’s Commitment to Cybersecurity

Apple’s quick response to these vulnerabilities showcases its commitment to advanced application security and robust incident response. Zero-day vulnerabilities will continue to emerge, and organizations using Apple products should maintain up-to-date security training, threat awareness, and device management policies.

Final Takeaway

In a world where cyber threats evolve constantly, Apple’s ongoing security updates are crucial defenses against unknown, active threats. Make it a priority to install these updates on all Apple devices to protect your data and your network from exploitation.

Editor's Note: This blog was updated on November 14, 2024.