Security News > 2024 > May > Apple backports fix for RTKit iOS zero-day to older iPhones
Apple has backported security patches released in March to older iPhones and iPads, fixing an iOS Kernel zero-day tagged as exploited in attacks.
Today, Apple backported the March security updates to address this security flaw on iOS 16.7.8, iPadOS 16.7.8, and macOS Ventura 13.6.7 with improved input validation.
Apple has yet to disclose who disclosed the zero-day or whether it was discovered internally, and it has provided no information on the nature of the attacks exploiting it in the wild.
Even though Apple has not released details regarding CVE-2024-23296 exploitation, iOS zero-days are commonly used in state-sponsored spyware attacks targeting high-risk individuals, including journalists, dissidents, and opposition politicians.
In January, Apple also backported patches for two WebKit zero-days, which were patched in November for newer devices.
With today's iOS 17.5 update, Apple has also added support for unwanted tracking alerts.
News URL
Related news
- Apple backports fix for zero-day exploited in attacks to older iPhones (source)
- Apple backports iOS zero-day patch, adds Bluetooth tracker alert (source)
- Apple and Google add alerts for unknown Bluetooth trackers to iOS, Android (source)
- Apple fixes Safari WebKit zero-day flaw exploited at Pwn2Own (source)
- Apple wasn’t storing deleted iOS photos in iCloud after all (source)
- Apple to unveil new 'Passwords' password manager app for iPhones, Macs (source)
- Apple iOS 18 Cheat Sheet: Release Date, RCS Integration and More (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-03-05 | CVE-2024-23296 | Out-of-bounds Write vulnerability in Apple products A memory corruption issue was addressed with improved validation. | 7.8 |