Apple addresses newly disclosed zero-day in multiple older iOS devices

Apple has published new security upgrades that backport fixes announced earlier this week to older iPhones and iPads in order to address an actively exploited zero-day vulnerability.

Monday, October 24th, Apple released a fix for the vulnerability (CVE-2022-42827) affecting iPhone and iPad devices. If successfully exploited, it may be used by potential attackers to execute arbitrary code with kernel privileges.

An anonymous researcher informed Apple about the out-of-bounds write data, which occurs when the program can write data beyond the limits of the memory buffer.

Data corruption, program crashes, and code execution owing to undefined or unexpected effects (memory corruption) from subsequent data sent to the buffer are all possible outcomes.

Apple patched the zero-day issue in iOS 15.7.1 and iPadOS 15.7.1 with enhanced bounds checking today.

The affected devices include the iPhone 6s and subsequent models, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation). Patch your older gadgets to prevent attacks

Apple stated that the security issue _"may have been actively exploited"_ in the wild, although the company has yet to share details surrounding these attacks.

Even though this zero-day vulnerability was likely only exploited in targeted attacks, it is highly advised that even older devices be patched as soon as possible to thwart any attack efforts.

CISA listed this zero-day vulnerability to its inventory of known exploitable vulnerabilities on October 25, requiring Federal Civilian Executive Branch (FCEB) entities to apply a fix to safeguard _" against active attacks."_

Since the beginning of this year, Apple has patched nine zero-day vulnerabilities:

Apple patched an iOS Kernel vulnerability in September (CVE-2022-32917).
In August, Apple patched two zero-day vulnerabilities in the iOS Kernel (CVE-2022-32894) and WebKit (CVE-2022-32893)
In March, Apple corrected two zero-day flaws in the Intel Graphics Driver (CVE-2022-22674) and AppleAVD (CVE-2022-22675).
In February, Apple provided security fixes to address a second zero-day WebKit vulnerability exploited against iPhones, iPads, and Macs.
In January, Apple addressed a pair of zero-day vulnerabilities enabling code execution with kernel privileges (CVE-2022-22587) and tracking of online surfing activity (CVE-2022-22594).

Apple addresses newly disclosed zero-day in multiple older iOS devices

Related threat feeds

630GB of Apple and Tesla Data Leaked in Tata Electronics Breach

FIFA World Cup Broadcast Infrastructure Exposed Through Broken Authorization Flaw

Splunk Enterprise Vulnerability Enables Unauthenticated Remote Code Execution