Security News > 2022 > January > Apple Releases iPhone and iPad Updates to Patch HomeKit DoS Vulnerability
Apple on Wednesday rolled out software updates for iOS and iPadOS to remediate a persistent denial-of-service issue affecting the HomeKit smart home framework that could be potentially exploited to launch ransomware-like attacks targeting the devices.
The iPhone maker, in its release notes for iOS and iPadOS 15.2.1, termed it as a "Resource exhaustion issue" that could be triggered when processing a maliciously crafted HomeKit accessory name, adding it addressed the bug with improved validation.
The so-called "DoorLock" vulnerability, tracked as CVE-2022-22588, affects HomeKit, the software API for connecting smart home devices to iOS applications.
Should it be successfully exploited, iPhones and iPads can be sent into a crash spiral simply by changing the name of a HomeKit device to a string larger than 500,000 characters and tricking the target into accepting a malicious Home invitation.
Even worse, since HomeKit device names are backed up to iCloud, signing back into the affected iCloud account linked to the HomeKit device can re-trigger the DoS condition and cause the devices to enter an endless cycle of crash and reboot that can only be ended by restoring them to their factory settings.
Although the company attempted to mitigate the problem by introducing a limit on the length of the name an app or the user can set, it was found that it did nothing to prevent an attacker from running an earlier version that allows excessively long device names and then getting the victim to accept a rogue invitation via a phishing email.
News URL
https://thehackernews.com/2022/01/apple-releases-iphone-and-ipad-updates.html
Related news
- Apple's trademark tight lips extend to new iPhone, iPad zero-days (source)
- Fraudsters tried to scam Apple out of 5,000 iPhones worth over $3 million (source)
- Researchers Detail Apple's Recent Zero-Click Shortcuts Vulnerability (source)
- Apple fixes two new iOS zero-days exploited in attacks on iPhones (source)
- Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability (source)
- Hardware-level Apple Silicon vulnerability can leak cryptographic keys (source)
- New "GoFetch" Vulnerability in Apple M-Series Chips Leaks Secret Encryption Keys (source)
- New GoFetch Vulnerability in Apple’s M Chips Allows Secret Keys Leak on Compromised Computers (source)
- Hardware Vulnerability in Apple’s M-Series Chips (source)
Related Vulnerability
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2022-03-18 | CVE-2022-22588 | Improper Input Validation vulnerability in Apple Iphone OS A resource exhaustion issue was addressed with improved input validation. | 5.5 |