Apple's latest security updates for iOS, macOS, Safari, visionOS, and iPadOS contained brief but critical disclosures of two actively exploited vulnerabilities.
The tech giant said Clément Lecigne and Benoît Sevens of Google's Threat Analysis Group discovered the vulnerabilities. NIST lists the vulnerabilities as CVE-2024-44308 and CVE-2024-44309.
What are the vulnerabilities that Apple patched?
Apple did not reveal much information about the exploit or what attackers could have done using these vulnerabilities. However, the Threat Analysis Group works specifically on “hacking and government-backed attacks against Google and our users,” so it is possible that these vulnerabilities were used in well-funded attacks against specific targets.
SEE: Do you want to accept Apple Pay in your business? See how with our guide.
With CVE-2024-44308, attackers could create malicious web content, leading to arbitrary code execution. Apple has detected that this exploit is possibly being used on Intel-based Mac systems, as opposed to systems using Apple's own M chips, which have been the standard since 2023. Apple has implemented improved controls to prevent this issue.
CVE-2024-44309 has been exploited in a similar way and applies to Intel-based Macs, but the fix was different. Apple said its team addressed a cookie management issue by improving state management.
The affected operating systems are:
- Safari 18.1.1
- iOS 17.7.2
- iPadOS 17.7.2
- macOS Sequoia 15.1.1
- iOS 18.1.1
- iPadOS 18.1.1
- visionOS 2.1.1
Apple faced four zero-day vulnerabilities in early 2024
In addition to the latest exploits, Apple disclosed four zero-day vulnerabilities this year, and patched all of them:
- CVE-2024-27834, a pointer authentication bypass.
- CVE-2024-23222, an arbitrary code execution vulnerability.
- CVE-2024-23225, a memory corruption issue.
- CVE-2024-23296, another memory corruption issue.
Apple devices are reputed to be safe from viruses and malware, in part due to Apple's tight control over its App Store ecosystem. However, that does not mean that these devices are immune to all attacks. According to multiple reports, threat actors are increasing their efforts to breach macOS, especially with information stealers and Trojans.
In April, Apple notified select users that their iPhones had been compromised by “a mercenary spyware attack,” in a case of threat actors targeting specific individuals. Other vulnerabilities may arise in hardware, such as the GoFetch vulnerability that appeared in Apple's M-series chips earlier this year.
Maintain cybersecurity best practices
Zero-day disclosures are good opportunities for IT teams to remind users to stay up to date with operating system updates and follow company security guidelines. Strong passwords or two-factor authentication can make a big difference. Many cybersecurity best practices apply across all operating systems, including Apple's.
