Security News > 2022 > August > Apple patches double zero-day in browser and kernel – update now!
Apple just pushed out an emergency update for two zero-day bugs that are apparently actively being exploited.
There's a remote code execution hole dubbed CVE-20220-32893 in Apple's browser and HTML rendering software, by means of which a booby trapped web page can trick iPhones, iPads and Macs into running unauthorised and untrusted software code.
There's also a kernel code execution hole dubbed CVE-2022-32894, by which an attacker who has already gained a basic foothold on your Apple device by exploiting the abovementioned WebKit bug.
Could jump from controlling just a single app on your device to taking over the operating system kernel itself, thus acquiring the sort of "Admininstrative superpowers" normally reserved for Apple itself.
Apple hasn't said how these bugs were found, hasn't said where in the world they've been exploited, and hasn't said who's using them or for what purpose.
At the time of writing, Apple has published advisories for iPad OS 15 and iOS 15, which both get updated version numbers of 15.6.1, and for macOS Monterey 12, which gets an updated version number of 12.5.2.
News URL
Related news
- We call this kernel saunters: How Apple rearranged its XNU core with exclaves (source)
- Apple fixes WebKit zero-day exploited in ‘extremely sophisticated’ attacks (source)
- Apple Releases Patch for WebKit Zero-Day Vulnerability Exploited in Targeted Attacks (source)
- Microsoft patches Windows Kernel zero-day exploited since 2023 (source)
- Apple backports zero-day patches to older iPhones and Macs (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-08-24 | CVE-2022-32894 | Out-of-bounds Write vulnerability in Apple products An out-of-bounds write issue was addressed with improved bounds checking. | 7.8 |