Apple Fixes New Kernel Zero-Day Bug That Attacks iPhones, iPads Remotely

Since the start of this year, there have been 8 zero-day vulnerabilities discovered by Apple that have been used to attack iPhones and iPads remotely. The ninth zero-day bug (CVE-2022-42827) has now been fixed by Apple as part of the latest security updates.

In a recent announcement, Apple confirmed that CVE-2022-42827 is an active flaw that is being exploited in the wild. It was also warned by Apple in a security assessment that this vulnerability could lead to arbitrary code execution attacks against iPhones and iPads.

The CVE-2022-42827 is a zero-day vulnerability that exploits out-of-bounds writes to the kernel. There are at least 20 known security issues that have been fixed with this major iOS update.

Apple was informed about this zero-day flaw by an anonymous researcher who reported the vulnerability anonymously. An insufficient memory buffer is a consequence of software writing data outside the current memory buffer boundaries, and it’s the actual cause of this flaw.

Exploitation Effect

Here below we have mentioned the effects of flaws that can appear if exploited by threat actors:-

• Data corruption
• Application crashes
• Remote code execution

A subsequent write of data to the buffer will result in these undefined results. Apart from this, with kernel privileges, the threat actors could also execute arbitrary code remotely on the affected devices.

Name and information link	Available for	Release date
Safari 16.1	macOS Big Sur and macOS Monterey	24 Oct 2022
iOS 16.1 and iPadOS 16	iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, iPad mini 5th generation and later	24 Oct 2022
macOS Big Sur 11.7.1	macOS Big Sur	24 Oct 2022
macOS Monterey 12.6.1	macOS Monterey	24 Oct 2022
macOS Ventura 13	Mac Studio (2022), Mac Pro (2019 and later), MacBook Air (2018 and later), MacBook Pro (2017 and later), Mac mini (2018 and later), iMac (2017 and later), MacBook (2017), and iMac Pro (2017)	24 Oct 2022
tvOS 16.1	Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD	24 Oct 2022
watchOS 9.1	Apple Watch Series 4 and later	24 Oct 2022

Affected Devices

Here below we have mentioned all the Apple devices that are affected by this zero-day:-

• All iPhone models starting from the iPhone 8
• All iPad Pro models
• All iPad Air models starting from the iPad Air 3rd generation
• All iPad models starting from the iPad 5th generation
• All iPad models starting from the iPad mini 5th generation

The following versions of Apple’s software have been updated to address this zero-day vulnerability:-

• iOS 16.1
• iPadOS 16

Additionally, Apple has also improved its bounds checking with these latest updates. However, Apple has not yet announced any information regarding the exploits of this vulnerability.

Apple intends to ensure all its users are patched as soon as possible to make sure that they are secure from any exploits or attacks that may be targeted at them.

Managed DDoS Attack Protection for Applications – Download Free Guide