Apple on Wednesday released a security patch to address a new zero-day flaw in iOS and iPadOS that it said is being actively exploited.
Tracked as CVE-2023-42824, the kernel vulnerability can be abused by a local attacker to escalate their privileges. The iPhone maker said it has resolved the issue with improved testing.
“Apple is aware of a report that this issue may have been actively exploited against iOS versions prior to iOS 16.6,” the company said in a brief advisory.
Although additional details regarding the nature of the attacks and the identity of the threat actors carrying out them are currently unknown, the likelihood of successful exploitation depends on the attacker already having an initial foothold through some other means.
Apple’s latest update also addresses CVE-2023-5217 affecting the WebRTC component, which Google described last week as a heap-based buffer overflow in the VP8 compression format in libvpx.
The patches, iOS 17.0.3 and iPadOS 17.0.3, are available for the following devices –
- iPhone XS and later
- iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later
With the new development, Apple has addressed a total of 17 zero-days actively used in its software since the beginning of the year.
It also arrives two weeks after Cupertino rolled out fixes to resolve three issues (CVE-2023-41991, CVE-2023-41992, and CVE-2023-41993), all of which are said to have been abused by an Israeli spyware vendor named Cytrox to deliver the Predator malware onto the iPhone belonging to former Egyptian member of parliament Ahmed Eltantawy earlier this year.
Worth noting here is that CVE-2023-41992 also refers to a flaw in the kernel that allows local attackers to gain privilege escalation.
It is not immediately clear whether the two flaws have any relation to each other, and whether CVE-2023-42824 is a patch bypass for CVE-2023-41992.
Sequoia said in a recent analysis that in December 2021, infrastructure similarities were found between clients of Cytrox (aka Lycantrox) and another commercial spyware company called Candiru (aka Karkadann), possibly due to both using spyware technologies.
“The infrastructure used by Lycantrox consists of VPS hosted in multiple autonomous systems,” the French cybersecurity firm said, adding that each customer runs its own instance of the VPS and manages its own domain name associated with it.
Users who are at risk of being targeted are recommended to enable Lockdown Mode to reduce the risk of mercenary spyware exploits.