Apple has released security updates to fix a new zero-day vulnerability exploited in the wild by attackers to hack iPhones, iPads, and Macs.
The zero-day patched today is tracked as CVE-2022-22620 and is a WebKit Use After Free issue that could lead to OS crashes and code execution on compromised devices.
Successful exploitation of this bug allows attackers to execute arbitrary code on iPhones and iPads running vulnerable versions of iOS and iPadOS after processing maliciously crafted web content.
“Apple is aware of a report that this issue may have been actively exploited,” the company said when describing the zero-day.
Apple addressed CVE-2022-22620 with improved memory management in iOS 15.3.1, iPadOS 15.3.1, and macOS Monterey 12.2.1.
The complete list of impacted devices is quite extensive, as the bug affects older and newer models, and it includes:
- iPhone 6s and later,
- iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)
- Macs running macOS Monterey
Although this zero-day was likely only used in targeted attacks, it’s still strongly recommended to install the updates as soon as possible to block potential attack attempts.
Third zero-day patched this year by Apple
In January, Apple patched two other zero-days exploited in the wild that could allow threat actors to achieve arbitrary code execution with kernel privileges (CVE-2022-22587) and track browsing activity and users’ identities in real-time (CVE-2022-22594).
These first two zero-days impacted iPhones (iPhone 6s and up), Macs running macOS Monterey, and multiple models of iPads.
While Apple has patched only three zero-days since the start of 2022, the company had to deal with an almost interminable stream of zero-days exploited in the wild to target iOS, iPadOS, and macOS devices.
The list includes multiple zero-day flaws used to install NSO’s Pegasus spyware on iPhones belonging to journalists, activists, and politicians.
Source: Bleeping Computer
