CISA Warns of Active Exploitation of Critical Vulnerability in iOS, iPadOS, and macOS

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday extra a superior-severity flaw impacting iOS, iPadOS, macOS, tvOS, and watchOS to its Recognized Exploited Vulnerabilities (KEV) catalog, based mostly on evidence of lively exploitation.

The vulnerability, tracked as CVE-2022-48618 (CVSS score: 7.8), fears a bug in the kernel component.

“An attacker with arbitrary read through and create ability could be able to bypass Pointer Authentication,” Apple said in an advisory, adding the issue “may have been exploited towards versions of iOS produced before iOS 15.7.1.”

The iPhone maker claimed the problem was tackled with improved checks. It really is at the moment not acknowledged how the vulnerability is currently being weaponized in authentic-world assaults.

Apparently, patches for the flaw ended up unveiled on December 13, 2022 with the release of iOS 16.2, iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, and watchOS 9.2, despite the fact that it was only publicly disclosed a lot more than a year later on on January 9, 2024.

It’s worth noting that Apple did solve a related flaw in the kernel (CVE-2022-32844, CVSS score: 6.3) in iOS 15.6 and iPadOS 15.6, which was shipped on July 20, 2022.

“An application with arbitrary kernel go through and write functionality could be ready to bypass Pointer Authentication,” the firm stated at the time. “A logic issue was tackled with enhanced point out administration.”

In light-weight of the active exploitation of CVE-2022-48618, CISA is recommending that Federal Civilian Government Branch (FCEB) businesses apply the fixes by February 21, 2024.

The enhancement also will come as Apple expanded patches for an actively exploited security flaw in the WebKit browser motor (CVE-2024-23222, CVSS score: 8.8) to contain its Apple Vision Pro headset. The repair is available in visionOS 1..2.

Identified this write-up intriguing? Observe us on Twitter  and LinkedIn to go through more special articles we article.

Some parts of this article are sourced from:
thehackernews.com