Apple Zero-Day Tracker.

This page holds short security alerts about Apple zero-day vulnerabilities and the updates that fixed them. It covers 6 items from April 2022 to March 2024. Each entry keeps its original title, publish date and text, newest first and grouped by quarter. Earlier addresses of these entries now lead to the matching entry here.

Jump to: 2024 Q1 | 2023 Q3 | 2022 Q4 | 2022 Q2

2024 Q1

Apple Releases Urgent Updates To Address Actively Exploited Zero-Day Vulnerabilities

Published: 7 March 2024

Apple has swiftly responded to critical security concerns by releasing urgent updates to rectify two actively exploited zero-day vulnerabilities. These vulnerabilities, CVE-2024-23225 and CVE-2024-23296, pose significant risks, allowing attackers with arbitrary kernel read and write capabilities to bypass crucial kernel memory protections. Apple has addressed these issues through enhanced validation mechanisms implemented in iOS 17.4, iPadOS 17.4, iOS 16.7.6, and iPadOS 16.7.6.

The updates cater to a wide range of Apple devices, including iPhones, iPads, and specific models such as iPhone 8 and later, as well as iPad Pro models from the 2nd generation onwards. This proactive approach from Apple marks the third instance this year where the company has tackled actively exploited zero-day vulnerabilities. Previously, Apple addressed a confusion flaw in WebKit, which could lead to arbitrary code execution across various Apple platforms, including iOS, iPadOS, macOS, tvOS, and Safari web browser.

Meanwhile, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged two additional vulnerabilities, urging prompt updates to mitigate potential risks. These vulnerabilities encompass an information disclosure flaw affecting Android Pixel devices (CVE-2023-21237) and an operating system command injection flaw in Sunhillo SureLine (CVE-2021-36380), which could result in code execution with root privileges. With indications of limited, targeted exploitation for CVE-2023-21237 and prior revelations of a Mirai botnet leveraging CVE-2021-36380, addressing these vulnerabilities remains critical to bolstering the overall cybersecurity posture.

2023 Q3

Apple Releases Urgent Patches To Address Zero-Day: Actively Exploited In The Wild

Published: 25 July 2023

Apple has released emergency security updates for various devices, including iPhones, iPads, Macs, Apple Watch, Apple TV and Safari. These updates fix several security vulnerabilities, including a zero-day bug actively used in the wild.

The specific vulnerability, tracked as CVE-2023-38606, affects the kernel and allows a malicious application to potentially alter the sensitive kernel state. Apple has addressed this issue with improved state management. The company is aware that this bug is actively used in iOS versions released prior to iOS 15.7.

This is the third vulnerability linked to Operation Triangle, an advanced cyberespionage campaign targeting iOS devices since 2019. Two other zero-days, CVE-2023-32434 and CVE-2023-32435, were patched by Apple the previous month.

Security updates are available for a variety of iOS and iPadOS devices, including:

• iPhone 8 and later,
• iPad Pro (all models),
• iPad Air 3rd generation and later,
• iPad 5th generation and later, and
• iPad mini 5th generation and later.

Also covered are:

• Apple TV 4K (all models), Apple TV HD, and
• Apple Watch Series 4 and later,
• macOS Ventura 13.5,
• macOS Monterey 12.6.8, and
• macOS Big Sur 11.7.9.

With this latest release, Apple has addressed a total of 11 zero-day vulnerabilities affecting its software since the beginning of 2023.

This update follows the company’s emergency fixes two weeks ago for an active bug in WebKit that could lead to arbitrary code execution (CVE-2023-37450).

In this context, it is recommended to use up-to-date versions with the vulnerability in order not to be the target of attacks that can be carried out using the vulnerability.

Operation Triangle

Security experts have uncovered an advanced, targeted cyberattack that leverages Apple’s mobile devices. The attack, named “Triangulation,” is aimed at planting covert spyware into the iPhones of employees of certain companies, including middle and top management personnel.

The cyberattack employs an invisible iMessage carrying a malicious attachment. Utilizing multiple vulnerabilities within the iOS operating system, the attachment is executed on the device, stealthily installing the spyware. This occurs without the need for user action. Once in place, the spyware discreetly relays sensitive data back to remote servers, including microphone recordings, instant messenger photos, geolocation, and other user activity data. [Read More]

Apple Releases Update For 0-Day Vulnerability

Published: 12 July 2023

Critical Vulnerability

Apple; has released security updates that fix the 0-day vulnerability affecting iOS, macOS, and iPadOS operating systems. The vulnerability affects the WebKit browser engine, which is used by multiple products to display web content.

The vulnerability, tracked by code CVE-2023-37450 and with a high severity rating, allows threat actors to generate malicious web content and execute arbitrary code on the target system.

Apple confirmed reports of active exploitation of the vulnerability and fixed it with improved controls. However, after the security updates, Safari browser (versions before 16.5.2) stated that some applications such as Facebook, Instagram, and Zoom gave an “Unsupported Browser” error.

The vulnerability affects versions earlier than:

• iOS 16.5.1,
• iPadOS 16.5.1,
• macOS Ventura 13.4.1, and
• Safari 16.5.2.

Updates that fix security vulnerabilities with critical risk levels have been released by Apple. Users using vulnerable versions are recommended to upgrade to updated versions as soon as possible.

Be Careful for Your Apple Devices

“Triangulation Trojan” Launches Sophisticated Attack on Apple Devices

Security experts have uncovered an advanced, targeted cyberattack that leverages Apple’s mobile devices. The attack, named “Triangulation,” is aimed at planting covert spyware into the iPhones of employees of certain companies, including middle and top management personnel.

The cyberattack employs an invisible iMessage carrying a malicious attachment. Utilizing multiple vulnerabilities within the iOS operating system, the attachment is executed on the device, stealthily installing the spyware. This occurs without the need for user action. Once in place, the spyware discreetly relays sensitive data back to remote servers, including microphone recordings, instant messenger photos, geolocation, and other user activity data. [Read More]

2022 Q4

Critical 0-Day Alarm On iOS And iPadOS

Published: 26 October 2022

Apple has released updates to 20 security vulnerabilities affecting iOS and iPadOS operating systems, including a 0-day vulnerability known to be actively exploited by threat actors.

The 0-day vulnerability, tracked as CVE-2022-42827, exists due to a boundary error affecting the “Kernel” component of the operating system. Threat actors can execute with root privileges on the vulnerable system by triggering an out-of-bounds write error through a specially crafted application.

Apart from the vulnerability mentioned above, Apple has also fixed two high-severity vulnerabilities with the released iOS 16.1 and iPadOS 16 updates. In order not to be the target of attacks that can be carried out using vulnerabilities, Apple users using vulnerable versions are recommended to apply the published updates immediately.

2022 Q2

A Critical Security Vulnerability Detected In Apple M1 Processor: “PACMAN”

Published: 12 June 2022

A new security vulnerability targeting Apple’s popular M1 processor has been identified by researchers at MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL). Called PACMAN, the attack is intended to circumvent the Pointer Authentication (PAC) mechanism in M1 and other ARM-based processors. PAC is a security feature that helps protect against threat actors that have gained memory access to the CPU. Pointers store memory addresses, and the PAC checks for unexpected pointer changes caused by an attack.

PACMAN vulnerability is in a hardware mechanism, so it is estimated that it cannot be remedied with a software update. What makes PACMAN vulnerability dangerous is that it directly affects the core. The core is the most privileged part of the operating system. Endangering the core means a threat actor can do everything the user can in a vulnerable system.

PACMAN can be triggered if there is any software vulnerability in the system, but there is no risk of endangering systems on their own. For example, memory corruption is one of the vulnerabilities that can cause PACMAN to be triggered. In this context, Apple users must keep their operating systems and software up-to-date.

New Zero Click Vulnerability Detected Affecting iOS Operating System

Published: 21 April 2022

Citizen Lab digital security researchers have detected a new zero click iMessage vulnerability, which is used to install Pegasus spyware on the iPhone devices of Catalan politicians, journalists, and activists. Pegasus is developed by the Israeli firm NSO and marketed to governments as licensed software for investigating terrorist activities. With Pegasus spyware, attacks were carried out on high-level authorities of many states such as the United Kingdom and Finland. Between 2017 and 2020, it was observed that Pegasus targeted at least 65 people by exploiting the Kismet iMessage vulnerability and a vulnerability in Whatsapp. Many people are among the recently observed campaign targets, such as Catalan members of the European Parliament, heads of state, judges, lawyers, and journalists.

The zero-click vulnerability, called HOMAGE, affected some versions before iOS 13.2 and was fixed in iOS 13.2. In the statement made by Apple officials, it was stated that users using the current version of iOS are not affected by the HOMAGE exploit. Spyware installed on target systems without any user interaction (zero-click) comes with many features such as reading messages on devices, listening to calls, capturing user passwords, location tracking, and accessing the device’s microphone and camera.

The campaign in question has not yet been attributed to any state or threat actor, but the findings indicate that the campaign was carried out by threat actors affiliated with the Spanish government. In this context, in order not to be the target of attacks that can be carried out using the said vulnerability and malicious software, it is recommended to keep the device/system or programs used in the latest version, download applications from official sources, and use a comprehensive anti-malware solution.