{"id":18139,"date":"2022-02-02T11:11:30","date_gmt":"2022-02-02T19:11:30","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/02\/02\/news-11872\/"},"modified":"2022-02-02T11:11:30","modified_gmt":"2022-02-02T19:11:30","slug":"news-11872","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2022\/02\/02\/news-11872\/","title":{"rendered":"Update now! Apple patches another actively used zero-day"},"content":{"rendered":"<p><strong>Credit to Author: Pieter Arntz| Date: Thu, 27 Jan 2022 21:56:12 +0000<\/strong><\/p>\n<p>Apple has released patches for iOS 15.3, iPadOS 15.3, and macOS Monterey 12.2 and is urging users to update. The most significant reasons are two actively exploited zero-day vulnerabilities, one of which has a publicly disclosed Proof-of-Concept (PoC).<\/p>\n<p>Using this vulnerability, designated <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-22587\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">CVE-2022-22587<\/a>, a malicious app could execute random code with kernel privileges.<\/p>\n<h2>Why did it take so long<\/h2>\n<p>The zero-day appears to have been found and reported by at least two researchers independently of each other. Apple acknowledged an anonymous researcher, Meysam Firouzi (@R00tkitSMM) of MBition \u2013 Mercedes-Benz Innovation Lab, and Siddharth Aeri (@b1n4r1b01) for having reported this flaw.<\/p>\n<p>The two researchers both stated that it took a long time for this bug to be acknowledged and fixed. One of them posted a Proof-of-Concept (PoC) on January 1st.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">while my californian friends are still waiting for 2022 how about a kernel oob read that works on the latest iOS 15.2 <img decoding=\"async\" src=\"https:\/\/s.w.org\/images\/core\/emoji\/13.1.0\/72x72\/1f642.png\" alt=\"\ud83d\ude42\" class=\"wp-smiley\" style=\"height: 1em; max-height: 1em;\" \/> <a href=\"https:\/\/t.co\/qo0WLLsQIV\">https:\/\/t.co\/qo0WLLsQIV<\/a> <a href=\"https:\/\/t.co\/HZA0y5Sghi\">https:\/\/t.co\/HZA0y5Sghi<\/a><\/p>\n<p>&mdash; binaryboy (@b1n4r1b01) <a href=\"https:\/\/twitter.com\/b1n4r1b01\/status\/1477172028524355585?ref_src=twsrc%5Etfw\">January 1, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script> <\/div>\n<\/figure>\n<p>The other researcher reported the issue through the Zero-Day-Initiative (ZDI) three months ago, waited for two months and then decided to report to Apple directly.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">I reported this vulnerability to <a href=\"https:\/\/twitter.com\/thezdi?ref_src=twsrc%5Etfw\">@thezdi<\/a> about 3 months ago and unfortunately they didn\u2019t answer me for like 2 months, then i canceled my report and sent it to apple directly. And we see it had been exploited in the wild. <a href=\"https:\/\/t.co\/RjnjiY4esr\">https:\/\/t.co\/RjnjiY4esr<\/a><\/p>\n<p>&mdash; Meysam Firouzi (@R00tkitSMM) <a href=\"https:\/\/twitter.com\/R00tkitSMM\/status\/1486477431431065601?ref_src=twsrc%5Etfw\">January 26, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script> <\/div>\n<\/figure>\n<p>The Zero Day Initiative (ZDI) was created to encourage the reporting of zero-day vulnerabilities privately to the affected vendors by financially rewarding researchers, although there has been some complaints from researchers that they didn&#8217;t feel they were taken seriously by the ZDI.<\/p>\n<h2>IOMobileFrameBuffer<\/h2>\n<p>CVE-2022-22587 is a memory corruption bug in the IOMobileFrameBuffer that affects iOS, iPadOS, and macOS Monterey. IOMobileFrameBuffer is a kernel extension for managing the screen FrameBuffer. An earlier vulnerability in this extension, listed as <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-30807\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">CVE-2021-30807<\/a>, was tied to the <a href=\"https:\/\/blog.malwarebytes.com\/privacy-2\/2021\/07\/pegasus-spyware-has-been-here-for-years-we-must-stop-ignoring-it\/\">Pegasus spyware<\/a>. Another one was listed as <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-30883\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">CVE-2021-30883<\/a> and also allowed an application to execute arbitrary code with kernel privileges. We hope that the input validation has now been curated to makes this impossible in the future.<\/p>\n<h2>Actively exploited<\/h2>\n<p>Apple <a href=\"https:\/\/support.apple.com\/en-us\/HT213053\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">acknowledged<\/a> that it was aware of a report that this issue may have been actively exploited.<\/p>\n<h2>Safari Webkit bug<\/h2>\n<p>The second zero-day is the Safari WebKit bug in iOS and iPadOS that <a href=\"https:\/\/blog.malwarebytes.com\/exploits-and-vulnerabilities\/2022\/01\/browsers-on-ios-ipados-and-mac-leak-your-browsing-activity-and-personal-identifiers\/\">allowed websites to track your browsing activity and users&#8217; identities<\/a> in real-time. After a researcher of FingerprintJS disclosed the bug in November, it was assigned the <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-22594\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">CVE-2022-22594<\/a> and has been fixed.<\/p>\n<h2>Updates<\/h2>\n<p>iOS 15.3 and iPadOS 15.3 fixes a total of ten security bugs. The updates are available for iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).<\/p>\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" data-attachment-id=\"54023\" data-permalink=\"https:\/\/blog.malwarebytes.com\/exploits-and-vulnerabilities\/2022\/01\/update-now-apple-patches-another-actively-used-zero-day\/attachment\/update_available\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/01\/Update_available.png\" data-orig-size=\"930,754\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"Update_available\" data-image-description=\"\" data-image-caption=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/01\/Update_available-300x243.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/01\/Update_available-600x486.png\" loading=\"lazy\" width=\"600\" height=\"486\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/01\/Update_available-600x486.png\" alt=\"iPadOS update available.\" class=\"wp-image-54023\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/01\/Update_available-600x486.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/01\/Update_available-300x243.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/01\/Update_available.png 930w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/figure>\n<\/div>\n<p>macOS Monterey 12.2 patches a total of 13 vulnerabilities in total. The latter also promises to bring smoother scrolling to MacBooks, fixing a previously reported scrolling issue in Safari.<\/p>\n<p>Apple also released security fixes for legacy versions of macOS Big Sur and Catalina.<\/p>\n<p>Stay safe, everyone!<\/p>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/exploits-and-vulnerabilities\/2022\/01\/update-now-apple-patches-another-actively-used-zero-day\/\">Update now! Apple patches another actively used zero-day<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/exploits-and-vulnerabilities\/2022\/01\/update-now-apple-patches-another-actively-used-zero-day\/\" target=\"bwo\" >https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><strong>Credit to Author: Pieter Arntz| Date: Thu, 27 Jan 2022 21:56:12 +0000<\/strong><\/p>\n<table cellpadding='10'>\n<tr>\n<td valign='top' align='center'><a href='https:\/\/blog.malwarebytes.com\/exploits-and-vulnerabilities\/2022\/01\/update-now-apple-patches-another-actively-used-zero-day\/' title='Update now! Apple patches another actively used zero-day'><img src='https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2021\/06\/patch_Apple.png' border='0'  width='300px'  \/><\/a><\/td>\n<\/tr>\n<tr>\n<td valign='top' align='left'>Apple has patched two zero-day vulnerabilities that were being used in the wild. Users are advised to update as soon as they can.<\/p>\n<p>Categories: <a href=\"https:\/\/blog.malwarebytes.com\/category\/exploits-and-vulnerabilities\/\" rel=\"category tag\">Exploits and vulnerabilities<\/a><\/p>\n<p>Tags: <a href=\"https:\/\/blog.malwarebytes.com\/tag\/iomobileframebuffer\/\" rel=\"tag\">IOMobileFrameBuffer<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/ios\/\" rel=\"tag\">iOS<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/ipados\/\" rel=\"tag\">iPadOS<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/macos\/\" rel=\"tag\">macOS<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/monterey\/\" rel=\"tag\">Monterey<\/a><\/p>\n<table width='100%'>\n<tr>\n<td align=right>\n<p><b>(<a href='https:\/\/blog.malwarebytes.com\/exploits-and-vulnerabilities\/2022\/01\/update-now-apple-patches-another-actively-used-zero-day\/' title='Update now! Apple patches another actively used zero-day'>Read more&#8230;<\/a>)<\/b><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/exploits-and-vulnerabilities\/2022\/01\/update-now-apple-patches-another-actively-used-zero-day\/\">Update now! Apple patches another actively used zero-day<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[22783,24748,10480,24749,10403,24750],"class_list":["post-18139","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-exploits-and-vulnerabilities","tag-iomobileframebuffer","tag-ios","tag-ipados","tag-macos","tag-monterey"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/18139","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=18139"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/18139\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=18139"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=18139"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=18139"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}