Friday, March 29, 2024

A 5-Year-Old Bug in Apple Safari Exploited in the Wild – Google Project Zero

An active exploit in the wild for a vulnerability in the Apple Safari web browser has been publicly revealed by the Google Project Zero team.

CVE-2022-22620 is the number assigned to the vulnerability. As of 2016, experts have discovered a way to bypass the fix that was implemented back in 2013. Since the flaw was first discovered and fixed in 2013.

This is a zero-day vulnerability “CVE-2022-22620” that has achieved a CVSS score of 8.8 and has been marked with a “High Severity” tag.

The CVE-2022-22620 is a case of a use-after-free vulnerability in WebKit, which affects the browser’s rendering engines. An attacker could exploit this zero-day flaw by creating maliciously composed web content to gain the ability to execute arbitrary code.

Technical Analysis

Apple shipped a patch for the bug in early February 2022 across all its platforms that included:-

  • Safari
  • iOS
  • iPadOS
  • macOS

In terms of the usefulness of the History API in 2013 and 2022, both bugs share several significant similarities. Despite this, their method of exploitation for them differs from one another. 

Following these changes, the zero-day flaw was revived in a zombie-like manner a few years after it had become dormant. While Maddie Stone from Google Project Zero expressed that these problems are not unusual to Safari. 

He further emphasized the need for taking the necessary time to analyze code and patches so that there are fewer instances where duplicate fixes are necessary and the effects of the changes on the security of our systems are better understood.

Here’s what Maddie Stone from Google Project Zero stated:-

“Both the October 2016 and the December 2016 commits were very large. The commit in October changed 40 files with 900 additions and 1225 deletions. The commit in December changed 95 files with 1336 additions and 1325 deletions. It seems untenable for any developers or reviewers to understand the security implications of each change in those commits in detail, especially since they’re related to lifetime semantics.”

The question of what should have been done differently is one that cannot be answered easily. As several best practices were already employed by the security experts responding to the original 2013 bug report.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates.

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles