⚡ TL;DR | Go Straight to the Apple Vulnerability Report
Apple has released security updates for macOS Monterey and for iOS and iPadOS which address 2 vulnerabilities that could lead to arbitrary code execution. Depending on that user’s privileges, an attacker could install new programs, view, change, or delete sensitive data, or even create new accounts with full user rights, further compromising the network. According to Apple’s post, both vulnerabilities may have been actively exploited. This update is reminiscent of Apple’s security updates in April, which also addressed 2 out-of-bounds kernel vulnerabilities.
CVE-2022-32893 & CVE-2022-32894
The vulnerabilities are both out-of-bounds write vulnerabilities, respectively in WebKit (CVE-2022-32893) and the operating system’s Kernel (CVE-2022-32894). CVE-2022-32893 could be exploited remotely by visiting a maliciously crafted website. A malware exploiting CVE-2022-32894 could potentially execute code with Kernel privileges. Since this is the highest level of privilege in the operating system, this would boil down to a complete device takeover.
Update Vulnerable devices
Apple has released the security updates macOS Monterey 12.5.1, iOS 15.6.1 and iPadOS 15.6.1. Any older versions are vulnerable to the vulnerabilities mentioned above. You can find detailed instructions on how to install the updates on Apple’s Security Updates page. Users are advised to apply the updates as soon as possible on any of the following devices:
- macOS Monterey
- iPhone 6s and later
- All models of iPad Pro
- iPad Air 2 and later
- iPad 5th generation and later
- iPad mini 4 and later
- iPod touch (7th generation)
Safari 15.6.1 Update
A day after the release of the macOS and iOS/iPadOS updates, Apple also released an update for Safari, specifically on macOS Big Sur and macOS Catalina. Any earlier versions of Safari are also vulnerable to CVE-2022-32893. Apple once again reports that this issue may have been actively exploited.
Discover Vulnerable Devices
Based on the information shared by Apple, we have created a special Lansweeper report that lists all macOS, iOS, and iPadOS devices that are still vulnerable to the vulnerabilities that are mentioned above. This way you have an actionable list of assets that still need to be updated.
