Apple Patches Zero-Day Bugs in macOS and iOS

Apple pushed out two separate patches for both their mobile iOS and the macOS used in Mac computers. The patches address vulnerabilities that are possibly already being exploited in the wild and allow for tampering with kernel activity on Apple devices.

Bugs affect both mobile devices and Mac computers

One patch fixes a vulnerability tracked under the designator CVE-2022-22675, which affects both operating systems. A separate patch fixing another vulnerability on just macOS was logged under CVE-2022-22674.

The first of those issues, shared by both of Apple's operating systems, resides in a component called AppleAVD. The bug could allow for arbitrary code execution on both iOS mobile devices and Macs, and potential threat actors could do that with kernel privileges.

An unnamed and anonymous researcher alerted Apple to the issues. The company further announced it was made aware of reports that this vulnerability may already be actively exploited, which is never good news.

While the CVE-2022-22675 bug was an out-of-bounds write issue, the other one, affecting only macOS, is described as an out-of-bounds read bug. This specific issue was discovered in the Intel graphics driver used by macOS. The bug allowed potential bad actors to access and read kernel memory. There are suspicious that this issue has also already been exploited actively before the patch was released.

Scarce details revealed by Apple

There is not much additional information about the specifics of the vulnerabilities and the possible ways they may have been exploited. Apple would likely disclose more detailed specs and data on the vulnerabilities and possible ways to abuse them once there has been more time to roll out patches and they have conducted a more complete investigation into the matter.