Apple has issued emergency fixes to address two new zero-day vulnerabilities in iOS that have the potential to impact iPhones. These vulnerabilities were identified in RTKit, identified as CVE-2024-23296, and the iOS Kernel, identified as CVE-2024-23225.
If these vulnerabilities were to be exploited by an attacker with kernel read and write privileges, they could potentially bypass kernel memory protections. Apple acknowledged reports that these vulnerabilities may have already been exploited, prompting the urgent release of fixes.
The Kernel CVE-2024-23225 vulnerability involved a memory corruption issue that was mitigated through improved validation measures. The company warned that attackers with arbitrary kernel read and write capability could potentially circumvent kernel memory protections.
The affected devices include iPhone XS and later models, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later.
The RTKit CVE-2024-23296 vulnerability also involved memory corruption, with enhanced validation measures implemented to address the issue. However, if an attacker gains arbitrary kernel read and write access, they might be able to bypass kernel memory protections. Apple did not disclose whether these zero-day vulnerabilities were discovered internally or reported by external parties.
In addition to the two zero-day vulnerabilities, Apple addressed other security flaws in their latest security updates. One fix was for a privacy vulnerability in the Accessibility feature (CVE-2024-23243) that could potentially allow apps to access sensitive location data. Another addressed a Safari Private Browsing flaw (CVE-2024-23256) that exposed users’ locked tabs when moving tab groups.
The company mentioned that additional patches for undisclosed vulnerabilities will be detailed in future advisories. Given that hackers are actively exploiting the identified flaws, it is crucial for users of vulnerable iPhones, iPads, or Macs to apply the latest security updates promptly.
For enhanced protection against malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, users can consider utilizing Perimeter81 malware protection. These threats can cause significant harm to networks and data security if left unchecked.
As the cybersecurity landscape continues to evolve, staying informed about the latest news, whitepapers, and infographics is essential. Individuals and organizations can follow reputable sources on platforms such as LinkedIn and Twitter for updates on cybersecurity trends and best practices.