Apple has taken prompt action to address a series of zero-day vulnerabilities that were actively exploited in targeted attacks on iPhones, Macs, and iPads. The company’s advisory highlights two critical flaws: CVE-2023-37450 affecting WebKit and CVE-2023-38606 impacting the iOS Kernel. Attackers were exploiting these weaknesses to gain unauthorized access to sensitive data and modify kernel states, potentially compromising user privacy and security.
To safeguard its users, Apple swiftly released a new round of Rapid Security Response (RSR) updates, enhancing checks and state management.
The first vulnerability, CVE-2023-37450, related to WebKit, and Apple acknowledged its potential active exploitation. The second zero-day, CVE-2023-38606, specifically targeted older iOS releases before version 15.7.1 and was part of a zero-click exploit chain used to deploy Triangulation spyware via iMessage exploits.
Kaspersky GReAT lead security researcher Boris Larin noted this concerning development. Apple also backported security patches for another zero-day (CVE-2023-32409) addressed in May to devices running tvOS 16.6 and watchOS 9.6.
The security updates covered multiple Apple platforms, including macOS Ventura 13.4, iOS and iPadOS 16.5, tvOS 16.5, watchOS 9.5, and Safari 16.5. It aimed to fortify these systems with improved bounds checks, input validation, and memory management. The affected devices encompass various iPhone and iPad models, as well as Macs running macOS Big Sur, Monterey, and Ventura. Apple’s response demonstrated its commitment to proactively tackling vulnerabilities and safeguarding its user base from emerging threats.
This marks the eleventh zero-day vulnerability that Apple has addressed this year alone, emphasizing the ongoing challenges in the cybersecurity landscape. Previous fixes addressed various zero-day flaws exploited by attackers targeting iOS, macOS, and iPadOS devices. Despite Apple’s swift actions, the company also encountered challenges with its Rapid Security Response updates, requiring the release of fixed versions after breaking web browsing on some websites.
Users are strongly encouraged to promptly apply updates and adopt additional security measures, such as regular system updates, to enhance protection against evolving cyber threats.
