Apple Releases iOS and macOS Updates to Patch Actively Exploited 0-Day Vulnerability

Apple on Wednesday released^[1] iOS 15.3 and macOS
Monterey 12.2 with a fix for the privacy-defeating bug in Safari,
as well as to contain a zero-day flaw, which it said has been
exploited in the wild to break into its devices.

Tracked as CVE-2022-22587, the vulnerability
relates to a memory corruption issue in the IOMobileFrameBuffer
component that could be abused by a malicious application to
execute arbitrary code with kernel privileges.

The iPhone maker said it’s “aware of a report that this issue
may have been actively exploited,” adding it addressed the issue
with improved input validation. It did not reveal the nature of the
attacks, how widespread they are, or the identities of the threat
actors exploiting them.

An anonymous researcher along with Meysam Firouzi and Siddharth
Aeri have been credited with discovering and reporting the
flaw.

CVE-2022-22587 is the third zero-day vulnerability discovered in
IOMobileFrameBuffer in a span of six months after CVE-2021-30807^[2]
and CVE-2021-30883^[3]. In December 2021, Apple
resolved^[4]
four additional weaknesses in the kernel extension that’s used to
manage the screen framebuffer.

Also fixed by the tech giant is a recently disclosed vulnerability in Safari^[5]
that stemmed from a faulty implementation of the IndexedDB API^[6]
(CVE-2022-22594), which could be abused by a malicious website to
track users’ online activity in the web browser and even reveal
their identity.

Other flaws of note include —

• CVE-2022-22584 – A memory corruption issue in
  ColorSync that may lead to arbitrary code execution when processing
  a malicious crafted file
• CVE-2022-22578 – A logic issue in Crash
  Reporter that could allow a malicious application to gain root
  privileges
• CVE-2022-22585 – A path validation issue in
  iCloud that could be exploited be a rogue application to access a
  user’s files
• CVE-2022-22591 – A memory corruption issue in
  Intel Graphics Driver that could be abused by a malicious
  application to execute arbitrary code with kernel privileges
• CVE-2022-22593 – A buffer overflow issue in
  Kernel that could be abused by a malicious application to execute
  arbitrary code with kernel privileges
• CVE-2022-22590 – A use-after-free issue in
  WebKit that may lead to arbitrary code execution when processing
  maliciously crafted web content

The updates^[7]
are available for iPhone 6s and later, iPad Pro (all models), iPad
Air 2 and later, iPad 5th generation and later, iPad mini 4 and
later, iPod touch (7th generation), and macOS devices running
Big Sur^[8], Catalina^[9], and Monterey^[10].