In security updates released yesterday, Apple has fixed the tenth zero-day vulnerability since the start of the year, with this latest one actively used in attacks against iPhones. The vulnerability was disclosed in security bulletins released yesterday for iOS/iPadOS 15.7.2, Safari 16.2, tvOS 16.2, and macOS Ventura 13.1, with Apple warning that the flaw “may have been actively exploited” against previous versions. The bug (CVE-2022-42856) is a type confusion issue in Apple’s Webkit web browser browsing engine. The flaw was discovered by Clément Lecigne of Google’s Threat Analysis Group, allowing maliciously crafted web content to perform arbitrary code execution on a vulnerable device. Arbitrary code execution could allow the malicious site to execute commands in the operating system, deploy additional malware or spyware, or perform other malicious actions. Apple addressed the zero-day vulnerability with improved state handling for the following devices: iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation). While Apple has disclosed that threat actors actively exploited the vulnerability, they have yet to provide any details on the attacks. However, as the vulnerability was discovered by Google’s Threat Intelligence Team, additional information will likely be published in a future blog post. This delay in providing details is commonly done to allow users time to patch their devices before other threat actors analyze the fixes and develop their own exploits.
Analyst Notes
Even though this zero-day flaw was likely used in highly-targeted attacks, it is still suggested to install the security updates as soon as possible.
https://www.bleepingcomputer.com/news/apple/apple-security-update-fixes-new-ios-zero-day-used-to-hack-iphones/
