Apple fixes new zero-day exploited to hack macOS, iOS devices

Apple has released security updates to fix two zero-day vulnerabilities, with one publicly disclosed and the other exploited in the wild by attackers to hack into iPhones and Macs.

The first zero-day patched today (tracked as CVE-2022-22587) [1, 2] is a memory corruption bug in the IOMobileFrameBuffer that affects iOS, iPadOS, and macOS Monterey.

Successful exploitation of this bug leads to arbitrary code execution with kernel privileges on compromised devices.

"Apple is aware of a report that this issue may have been actively exploited," Apple said when describing the zero-day bug.

The complete list of impacted devices includes:

• iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
• and macOS Monterey

The bug was found by an anonymous researcher, Meysam Firouzi (@R00tkitSMM) of MBition - Mercedes-Benz Innovation Lab, and Siddharth Aeri (@b1n4r1b01).

Firouzi and Aeri told BleepingComputer that they both found the bug independently and were unaware that threat actors exploited it in the wild.

The second zero-day is a Safari WebKit bug in iOS and iPadOS that allowed websites to track your browsing activity and users' identities in real-time.

The bug was first disclosed to Apple by Martin Bajanik of FingerprintJS on November 28th, 2021, and publicly disclosed on January 14th, 2022. After the researcher disclosed the bug, it was assigned the CVE-2022-22594 and fixed in today's iOS 15.3 and iPadOS 15.3 security update.

These bugs are the first zero-day vulnerabilities fixed by Apple in 2022.

However, Apple fixed what felt like a never-ending stream of zero-day bugs in 2021 that were used in attacks against iOS and macOS devices.

These bugs included numerous zero-day vulnerabilities used to install the Pegasus spyware on the iPhones of journalists, activists, and politicians.

Apple fixes new zero-day exploited to hack macOS, iOS devices