Friday, July 19, 2024

A 5-Year-Old Bug in Apple Safari Exploited in the Wild – Google Project Zero

An active exploit in the wild for a vulnerability in the Apple Safari web browser has been publicly revealed by the Google Project Zero team.

CVE-2022-22620 is the number assigned to the vulnerability. As of 2016, experts have discovered a way to bypass the fix that was implemented back in 2013. Since the flaw was first discovered and fixed in 2013.

This is a zero-day vulnerability “CVE-2022-22620” that has achieved a CVSS score of 8.8 and has been marked with a “High Severity” tag.

The CVE-2022-22620 is a case of a use-after-free vulnerability in WebKit, which affects the browser’s rendering engines. An attacker could exploit this zero-day flaw by creating maliciously composed web content to gain the ability to execute arbitrary code.

Technical Analysis

Apple shipped a patch for the bug in early February 2022 across all its platforms that included:-

  • Safari
  • iOS
  • iPadOS
  • macOS

In terms of the usefulness of the History API in 2013 and 2022, both bugs share several significant similarities. Despite this, their method of exploitation for them differs from one another. 

Following these changes, the zero-day flaw was revived in a zombie-like manner a few years after it had become dormant. While Maddie Stone from Google Project Zero expressed that these problems are not unusual to Safari. 

He further emphasized the need for taking the necessary time to analyze code and patches so that there are fewer instances where duplicate fixes are necessary and the effects of the changes on the security of our systems are better understood.

Here’s what Maddie Stone from Google Project Zero stated:-

“Both the October 2016 and the December 2016 commits were very large. The commit in October changed 40 files with 900 additions and 1225 deletions. The commit in December changed 95 files with 1336 additions and 1325 deletions. It seems untenable for any developers or reviewers to understand the security implications of each change in those commits in detail, especially since they’re related to lifetime semantics.”

The question of what should have been done differently is one that cannot be answered easily. As several best practices were already employed by the security experts responding to the original 2013 bug report.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates.


Latest articles

Hackers Claiming Dettol Data Breach: 453,646 users Impacted

A significant data breach has been reported by a threat actor known as 'Hana,'...

CrowdStrike Update Triggers Widespread Windows BSOD Crashes

A recent update from cybersecurity firm CrowdStrike has caused significant disruptions for Windows users,...

Operation Spincaster Disrupts Approval Phishing Technique that Drains Victim’s Wallets

Chainalysis has launched Operation Spincaster, an initiative to disrupt approval phishing scams that have...

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which...

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and...

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are...

Hackers Exploiting Legitimate RMM Tools With BugSleep Malware

Since October 2023, MuddyWater, which is an Iranian threat group linked to MOIS, has...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles