Apple has recently issued security patches for three vulnerabilities that are presently being exploited in the field in both macOS Catalina and iOS 12.5.5.
The latest, CVE-2021-30869, is an XNU vulnerability that lets malicious programs execute arbitrary code with kernel privileges on macOS, iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPod touch.
According to sources, an attack for the flaw remains, but Apple claims it has been fixed “with better state management.”
Another vulnerability, CVE-2021-30860, was identified by Citizen Lab which forwarded the artifacts to Apple on Tuesday, September 7.
“On Monday, September 13, Apple confirmed that the files included a zero-day exploit against iOS and MacOS. They designated the FORCEDENTRY exploit CVE-2021-30860, and describe it as ‘processing a maliciously crafted PDF may lead to arbitrary code execution,’” Citizen Lab wrote.
It might have links with the NSO Pegasus malware, which is used to hack into Apple iPhones. iPhone 5s, iPhone 6 & 6 Plus, iPad Air, iPad mini 2 & 3, and iPod touch (6th generation) are all affected by this vulnerability.
There was widespread anger when Citizen Lab published multiple reports revealing how NSO Pegasus malware provided some nation-states and criminal actors unfettered access to Apple devices.
According to Citizen Lab’s newest report, CVE-2021-30860 concerns how threat actors may leverage the processing of a maliciously designed PDF to run arbitrary code. Apple acknowledged that it had been aggressively abused and claimed it had been fixed “with enhanced input validation.”
“Our latest discovery of yet another Apple zero day employed as part of NSO Group’s arsenal further illustrates that companies like NSO Group are facilitating “despotism-as-a-service” for unaccountable government security agencies. Regulation of this growing, highly profitable, and harmful marketplace is desperately needed,” Citizen Labs concluded.
And the third bug is CVE-2021-30858. This vulnerability affected the same devices as the previous two and was shared anonymously. According to Apple, the flaw is related to how maliciously designed online content may lead to arbitrary code execution.
Apple has stated that this issue has been fixed with “enhanced memory management.”
