Apple has released patches to address multiple vulnerabilities impacting popular products, including iOS and iPadOS. Two of the vulnerabilities, CVE-2024-23225 and CVE-2024-23296, were reportedly exploited in attacks against iOS and macOS.
Apple mentioned in the advisory that it is aware of the exploitation of the vulnerabilities.
CVE-2024-23225 & CVE-2024-23296
The memory corruption vulnerability exists in the kernel. An attacker with read and write permission may exploit the vulnerability to bypass kernel memory protections. Apple has fixed the vulnerability with improved validation.
Affected Products and Versions
- iPhone XS and later
- iPad 6th generation and later
- iPad Air 3rd generation and later
- iPad mini 5th generation and later
- iPad Pro 12.9-inch 2nd generation and later
- iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later
- iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch, and iPad Pro 12.9-inch 1st generation
Mitigation
To patch the vulnerabilities, customers must upgrade to the latest macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5, iOS 17.4, and iPadOS 17.4.
For more information, please visit the Apple security advisories for macOS Ventura, macOS Monterey, macOS Sonoma, iOS, and iPadOS.
Qualys Detection
Qualys customers can scan their devices with QIDs 379476, 379477, 379478, 610549, and 610550 to detect vulnerable assets.
Please continue to follow Qualys Threat Protection for more coverage of the latest vulnerabilities.
References
https://support.apple.com/en-in/HT214081
https://support.apple.com/en-in/HT214082
https://support.apple.com/en-us/HT214083
https://support.apple.com/en-us/HT214084
https://support.apple.com/en-us/HT214085