The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding the active exploitation of critical vulnerabilities in multiple Apple products. This advisory comes shortly after the agency added a high-severity flaw to its Known Exploited Vulnerabilities (KEV) catalog. The threat pertains to a wide range of Apple operating systems and highlights the urgency for immediate remedial actions to mitigate potential cyberattacks.
Vulnerability Details:
- CVE ID: CVE-2022-48618
- CVSS Score: 7.8
- Affected Products: iOS, iPadOS, macOS, tvOS, and watchOS
- Vulnerability Type: Kernel Component Bug
- Description: This vulnerability allows an attacker with arbitrary read and write capabilities to bypass Pointer Authentication, posing a critical security risk. Apple has acknowledged that this flaw “may have been exploited against versions of iOS released before iOS 15.7.1.”
Actions Taken by Apple:
- Patches Released: Apple addressed this issue by releasing patches on December 13, 2022, for various operating systems, including iOS 16.2, iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, and watchOS 9.2.
- Previous Similar Issue: A related vulnerability, CVE-2022-32844 (CVSS score: 6.3), was previously addressed in iOS 15.6 and iPadOS 15.6, released on July 20, 2022. This flaw also involved bypassing Pointer Authentication due to a logic issue that was corrected with improved state management.
- Public Disclosure: Despite the patches being released in late 2022, the issue was only publicly disclosed over a year later, on January 9, 2024, underscoring the criticality and sensitivity of the vulnerability.
CISA Advisory and Deadline:
In response to the active exploitation of CVE-2022-48618, CISA has advised Federal Civilian Executive Branch (FCEB) agencies to apply the provided fixes by February 21, 2024, emphasizing the need for rapid action to protect federal networks and data.
Additional Security Concerns:
Apart from CVE-2022-48618, Apple has recently expanded patches for another actively exploited security flaw in the WebKit browser engine, identified as CVE-2024-23222 (CVSS score: 8.8). This vulnerability also extends to Apple’s Vision Pro headset, with the fix being available in visionOS 1.0.2, signifying the evolving threat landscape and the necessity for continuous vigilance and prompt response.
Conclusion:
The identification and active exploitation of CVE-2022-48618, along with other critical vulnerabilities in Apple’s ecosystem, highlight the persistent and sophisticated nature of cyber threats. Both CISA and Apple have taken significant steps to address these vulnerabilities. It is imperative for all organizations, especially FCEB agencies, to adhere to the advisory timelines and implement the necessary patches to safeguard their infrastructures from potential cyberattacks.
Stay safe and informed,
OP Innovate.
