{"id":92943,"date":"2021-01-26T20:17:49","date_gmt":"2021-01-27T04:17:49","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=92943"},"modified":"2021-01-29T13:59:09","modified_gmt":"2021-01-29T21:59:09","slug":"apple-patches-actively-exploited-security-flaws-in-ios-ipados","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/apple-patches-actively-exploited-security-flaws-in-ios-ipados\/","title":{"rendered":"Apple patches actively exploited security flaws in iOS, iPadOS"},"content":{"rendered":"

\"\"<\/p>\n

On Tuesday, January 26, Apple released iOS and iPadOS version 14.4, which address at least three zero-day vulnerabilities<\/a> that have been actively exploited in the wild, as well as updates for watchOS and tvOS. Here’s a brief overview of the security flaws and what Apple has done to fix them.<\/p>\n

The WebKit bugs<\/h3>\n

\"\"Two of the three zero-day bugs were addressed in WebKit\u2014Apple’s page rendering engine, which is used by Apple’s Safari browser and many parts of Apple operating systems.<\/p>\n

Apple says that because of these twin WebKit bugs, “A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.<\/strong>” The company says it fixed the issue by addressing a “logic issue [\u2026] with improved restrictions.”<\/p>\n

Reading between the lines, it sounds as though a victim’s iPhone or iPad could have been compromised (i.e. hacked) or exploited by an attacker, simply by the victim viewing a page or opening an e-mail created or modified by an attacker. Notably, this kind of attack may not necessarily\u00a0require the victim to click on a link within the theoretical page or e-mail.<\/p>\n

The kernel bug<\/h3>\n

\"kernelApple has also fixed a serious flaw in the kernel, the core component of Apple’s operating systems.<\/p>\n

According to the company, “A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited.<\/strong>”<\/p>\n

Regarding the fix, Apple says that: “A race condition was addressed with improved locking.”<\/p>\n

A\u00a0race condition<\/strong> is a scenario in which a task or procedure can be done out of the proper order. Race conditions can sometimes enable an attacker to do things they shouldn’t be able to do under normal circumstances.<\/p>\n

A privilege elevation<\/strong> (or privilege escalation<\/strong>) vulnerability enables attacks that would normally only be possible by someone with administrator or root permissions. Such vulnerabilities can make it possible to pull off attacks that may not be possible under normal conditions, or they can enable attacks to do more damage.<\/p>\n

This kernel bug does not merely affect iOS and iPadOS. The same kernel bug was also patched in tvOS 14.4 and watchOS 7.3<\/strong>, both of which were released simultaneously with the iOS and iPadOS updates on Tuesday.<\/p>\n

Where are the macOS updates?<\/h3>\n

\"FinderInterestingly, Apple has yet to release corresponding macOS updates for Big Sur (macOS 11) or the two previous Mac operating systems, macOS Catalina (10.15) and macOS Mojave (10.14).<\/p>\n

Apple usually releases macOS updates simultaneously iOS and other operating system updates. Occasionally, however, the urgency of an in-the-wild exploit warrants releasing some patches before all of them are ready to be released.<\/p>\n

That seems to be the case here. On Monday, Apple released the second release candidate for macOS 11.2, so presumably the macOS updates will arrive soon.<\/p>\n

Update:<\/strong> Apple deployed a third release candidate for macOS 11.2 on Thursday, January 28, and had not released the final version to the public by Friday. This seems to indicate that we may not see the next macOS release until around next Tuesday, February 2, or perhaps later.<\/p>\n

Other bugs patched, but not yet announced<\/h3>\n

At the bottom of each page listing the iOS 14.4\/iPadOS 14.4<\/a>, tvOS 14.4<\/a>, and watchOS 7.3<\/a> security update details, Apple noted in italics, “Additional details available soon.<\/strong><\/em>”<\/p>\n

When Apple releases operating system security updates out of sync with one another, the company often holds back some details until the remaining operating systems have been patched. This may especially be true if disclosing some details could lead attackers to guess at how to exploit the OS for which patches are not yet available.<\/p>\n

There’s a good chance that Apple will release macOS Big Sur 11.2\u2014and presumably security-only updates for Catalina and Mojave\u2014sometime next week, so keep an eye out for those updates.<\/p>\n

We’ll cover any macOS-specific security bugs, as well as any of the security bugs in this week’s OS releases that Apple hasn’t yet told us about, right here on The Mac Security Blog.<\/p>\n

How can I learn more?<\/span><\/h3>\n

\"\"<\/a>On this week’s episode of the Intego Mac Podcast<\/strong>, Intego’s experts discuss these new vulnerabilities and a lot more. Be sure to subscribe<\/a> to make sure you never miss the latest episode!<\/p>\n