Article Details
Scrape Timestamp (UTC): 2024-03-05 21:36:40.569
Original Article Text
Click to Toggle View
Apple fixes two new iOS zero-days exploited in attacks on iPhones. Apple released emergency security updates to fix two iOS zero-day vulnerabilities that were exploited in attacks on iPhones. "Apple is aware of a report that this issue may have been exploited," the company said in an advisory issued on Tuesday. The two bugs were found in the iOS Kernel (CVE-2024-23225) and RTKit (CVE-2024-23296), both allowing attackers with arbitrary kernel read and write capabilities to bypass kernel memory protections. The company says it addressed the security flaws for devices running iOS 17.4, iPadOS 17.4, iOS 16.76, and iPad 16.7.6 with improved input validation. The list of impacted Apple devices is quite extensive, and it includes: Apple has not shared who disclosed both zero-days or if they were discovered internally. While Apple has not released information regarding ongoing exploitation in the wild, iOS zero-day vulnerabilities are commonly used in state-sponsored spyware attacks against high-risk individuals, such as journalists, opposition politicians, and dissidents. While these zero-day vulnerabilities were likely only used in targeted attacks, installing today's security updates as soon as possible is highly advised to block potential attack attempts. With these two vulnerabilities, Apple has fixed three zero-days so far in 2024, with the first in January. Last year, the company fixed a total of 20 zero-day flaws exploited in the wild, including:
Daily Brief Summary
Apple has issued emergency security updates for iOS to address two zero-day vulnerabilities that were actively exploited.
The vulnerabilities, identified as CVE-2024-23225 and CVE-2024-23296, affect the iOS Kernel and RTKit, respectively.
These security loopholes could enable attackers with kernel access to circumvent memory protections.
Devices running iOS 17.4, iPadOS 17.4, iOS 16.76, and iPadOS 16.7.6 received patches with improved input validation.
There's a broad range of Apple devices impacted, though the company hasn't shared specific details about the disclosure source of the vulnerabilities.
While Apple remains tight-lipped about the specifics of the attacks, zero-days are typically harnessed in sophisticated espionage campaigns against select targets.
Users are urged to install the latest security updates promptly to prevent any future exploitation risks.
This year, Apple has already rectified three zero-days, following last year's fix of 20 zero-days that were similarly exploited in the wild.