Urgent Apple iOS and macOS Updates Released to Fix Actively Exploited Zero-Days

Apple on Thursday released security updates to fix multiple
security vulnerabilities in older versions of iOS^[1] and macOS^[2] that it says have been
detected in exploits in the wild, in addition to expanding patches
for a previously plugged security weakness abused by NSO Group’s
Pegasus surveillance tool to target iPhone users.

Chief among them is CVE-2021-30869, a type confusion flaw that
resides in the kernel component XNU^[3]
developed by Apple that could cause a malicious application to
execute arbitrary code with the highest privileges. The
Cupertino-based tech giant said it addressed the bug with improved
state handling.

Google’s Threat Analysis Group, which is credited with reporting
the flaw, said^[4]
it detected the vulnerability being “used in conjunction with a
N-day remote code execution targeting WebKit.”

Two other flaws include CVE-2021-30858 and CVE-2021-30860^[5], both of which were
resolved by the company earlier this month following disclosure
from the University of Toronto’s Citizen Lab about a previously
unknown exploit called “FORCEDENTRY” (aka Megalodon) that could
infect Apple devices without so much as a click.

The zero-click remote attack weaponizing CVE-2021-30860 is said
to have been carried out by a customer of the controversial Israeli
company NSO Group since at least February 2021. The scale and scope
of the operation remain unclear as yet.

It relied on iMessage as an entry point to send malicious code
that stealthily installed the Pegasus spyware on the devices and
exfiltrate sensitive data without tipping the victims off. The
exploit is also significant for its ability to get around defenses
built by Apple in iOS 14 — called BlastDoor — to prevent such
intrusions by filtering untrusted data sent over the texting
application.

The patches are available for devices running macOS Catalina and
iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad
mini 3, and iPod touch (6th generation) running iOS 12.5.4.

The development also comes as security researchers have
disclosed unpatched zero-day flaws in iOS, including a lock screen bypass bug^[6]
and a clutch of vulnerabilities that could be abused by an app to
gain access to users’ Apple ID email addresses and full names,
check if a specific app is installed on the device given its bundle
ID, and even retrieve Wi-Fi information without proper
authorization.

Researcher illusionofchaos, who disclosed^[7] the latter three issues,
said they were reported to Apple between March 10 and May 4.
Indeed, a Washington Post article published two weeks ago revealed^[8]
how the company sits on a “massive backlog” of vulnerability
reports, leaving them unresolved for months, hands out lower
monetary payouts to bug hunters, and, in some cases, outright bans
researchers from its Developer Program for filing reports.