Apple has released new security updates to backport zero-day patches released in March to Macs and Apple Watch devices running older OS versions.
Zero-days are security flaws that the software vendor is unaware of and hasn't yet patched. In some cases, this type of vulnerability may also have publicly available proof-of-concept exploits before a patch arrives or may be actively exploited in the wild.
In security advisories issued on Monday, Apple revealed that they're aware of reports this security bug "may have been actively exploited."
The flaw is an out-of-bounds write issue (CVE-2022-22675) in the AppleAVD (a kernel extension for audio and video decoding) that allows apps to execute arbitrary code with kernel privileges.
The bug was reported by anonymous researchers and fixed by Apple in macOS Big Sur 11.6., watchOS 8.6, and tvOS 15.5 with improved bounds checking.
The list of impacted devices includes Apple Watch Series 3 or late, Macs running macOS Big Sur, Apple TV 4K, Apple TV 4K (2nd generation), and Apple TV HD.
While Apple disclosed reports of active exploitation in the wild, it did not release any extra info regarding these attacks.
By withholding information, the company is likely aiming to allow the security updates to reach as many Apple Watches and Macs as possible before attackers pick up on the zero-day's details and start deploying exploits in other attacks.
Although this zero-day was most probably only used in targeted attacks, it's still strongly advised to install today's macOS and watchOS security updates as soon as possible to block attack attempts.
Five zero-days patched in 2022
In January, Apple patched two other zero-days exploited in the wild to let attackers gain arbitrary code execution with kernel privileges (CVE-2022-22587) and track web browsing activity and user identities in real-time (CVE-2022-22594).
One month later, Apple released security updates to patch a new zero-day bug (CVE-2022-22620) exploited to hack iPhones, iPads, and Macs, which leads to OS crashes and remote code execution on compromised Apple devices.
In March, two more actively exploited zero-days in the Intel Graphics Driver (CVE-2022-22674) and the AppleAVD media decoder (CVE-2022-22675), the latter also backported today in older versions of macOS, in watchOS 8.6, and in tvOS 15.5.
These five zero-days impact iPhones (iPhone 6s and up), Macs running macOS Monterey, and multiple iPad models.
Throughout last year, the company also patched a long list of zero-days exploited in the wild to target iOS, iPadOS, and macOS devices.
Update: Made it clearer that this is about backports of March patches for older OS versions.
Top 10 MITRE ATT&CK© Techniques Behind 93% of Attacks
Based on an analysis of 14M malicious actions, discover the top 10 MITRE ATT&CK techniques behind 93% of attacks and how to defend against them.
Comments
h_b_s - 2 years ago
No. A zero day is defined as a software or hardware defect publicly revealed at the same time as being revealed to the project or manufacturer AND being ACTIVELY EXPLOITED in KNOWN attacks. This has been the standard definition for decades.
It's disturbing to see people that are supposed to be following the security landscape continuously trying to redefine terms to match multi-billion dollar marketing departments' narratives.