Apple on Wednesday rolled out security patches to address a new zero-day flaw in iOS and iPadOS that it said has come under active exploitation in the wild.
Tracked as CVE-2023-42824, the kernel vulnerability could be abused by a local attacker to elevate their privileges. The iPhone maker said it addressed the problem with improved checks.
“Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6,” the company noted in a terse advisory.
While additional details about the nature of the attacks and the identity of the threat actors perpetrating them are currently unknown, successful exploitation likely hinges on an attacker already obtaining an initial foothold by some other means.
Apple’s latest update also resolves CVE-2023-5217 impacting the WebRTC component, which Google last week described as a heap-based buffer overflow in the VP8 compression format in libvpx.
The patches, iOS 17.0.3 and iPadOS 17.0.3, are available for the following devices –
- iPhone XS and later
- iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later
With the new development, Apple has addressed a total of 17 actively exploited zero-days in its software since the start of the year.
It also arrives two weeks after Cupertino rolled out fixes to resolve three issues (CVE-2023-41991, CVE-2023-41992, and CVE-2023-41993), all of which are said to have been abused by an Israeli spyware vendor named Cytrox to deliver the Predator malware onto the iPhone belonging to former Egyptian member of parliament Ahmed Eltantawy earlier this year.
A point worth noting here is that CVE-2023-41992 also refers to a shortcoming in the kernel that allows local attackers to achieve privilege escalation.
It’s not immediately clear if the two flaws have any connection with one another, and if CVE-2023-42824 is a patch bypass for CVE-2023-41992.
Sekoia, in a recent analysis, said it found infrastructure similarities between customers of Cytrox (aka Lycantrox) and another commercial spyware company called Candiru (aka Karkadann), likely due to them using both spyware technologies.
“The infrastructure used by the Lycantrox consists of VPS hosted in several autonomous systems,” the French cybersecurity firm said, with each customer appearing to run their own instances of VPS and manage their own domain names related to it.
Users who are at risk of being targeted are recommended to enable Lockdown Mode to reduce exposure to mercenary spyware exploits.