Apple emits iOS, iPadOS, watchOS, macOS patches to fix three hijack-my-device flaws exploited in the wild
(2020/11/06)
- Reference: 1604619695
- News link: https://www.theregister.co.uk/2020/11/05/apple_drops_patches_to_fix/
- Source link:
Apple on Thursday issued security updates for iOS, iPadOS, watchOS, and macOS that address three holes reported by Google's Project Zero bug hunters among exploitable flaws found by others. Installing the latest software for your iPhone, iPad and so on will address these programming blunders.
The iPhone giant's [1]security bulletins note that the three flaws discovered and reported by Project Zero – CVE-2020-27930 (remote-code execution), CVE-2020-27950 (kernel memory leak), and CVE-2020-27932 (kernel privilege-escalation) – are being actively exploited in the wild.
CVE-2020-27930 is a bug in Apple's font parser that can be exploited by a specially crafted font to achieve arbitrary code execution. CVE-2020-27950 covers a bug that allows a malicious application to disclose kernel memory. CVE-2020-27950 provides a way for a malicious application to run arbitrary code with kernel privileges.
You can probably imagine how these can be chained together to hijack someone's device: get them to open a document, message, or webpage that loads in a maliciously crafted font, which is parsed and triggers code execution with kernel privileges and silently commandeers the handheld.
Apple also issued a security update for tvOS, though that upgrade doesn't cover these three CVEs.
Here's a neat exploit to trick someone into inadvertently emailing their files to you from their Mac, iPhone via Safari [2]READ MORE
Via Twitter, Shane Huntley, director of Google's Threat Analysis Group, provided no additional detail beyond [3]stating that the vulnerabilities are being exploited against selected targets though haven't been used for election meddling.
The updates have been designated iOS 14.2 and iPadOS 14.2, watchOS 7.1, macOS 10.15.7, and tvOS 14.2.
Apple also issued iOS 12.4.9 for outdated iPhone models that it no longer supports in current iOS releases, going back to iPhone 5s. Older watchOS releases also saw updates in the form of watchOS 6.2.9 and 5.3.9. This suggests the bugs are serious enough to warrant an exception for unsupported devices.
The [4]iOS 14.2 and iPadOS 14.2 update covers a total of 24 CVEs including the three flagged by Google. Seventeen, including those three, allow arbitrary code execution. But only the Project Zero bugs are said to be under active exploitation.
Which is just as well because CVE-2020-27902, discovered by developer [5]Connor Ford , can be exploited by a "person with physical access to an iOS device ... to access stored passwords without authentication." This is present in the iOS Keyboard software component, and was fixed by improving the code's state machine.
The [6]watchOS 7.1 update cites 18 CVEs.
The [7]macOS 10.15.7 update only includes the three Project Zero bugs.
Next week, Apple is expected to introduce its first Arm-based [8]Apple Silicon notebook, marking a major chip architecture transition for the company. ®
Get our [9]Tech Resources
[1] https://support.apple.com/en-us/HT201222
[2] https://www.theregister.com/2020/08/26/safari_local_file_leak_api/
[3] https://twitter.com/ShaneHuntley/status/1324431104187670529?s=20
[4] https://support.apple.com/en-us/HT211929
[5] https://twitter.com/connorford2
[6] https://support.apple.com/en-us/HT211928
[7] https://support.apple.com/en-us/HT211947
[8] https://www.theregister.com/2020/06/23/apple_armed_for_x86_rebellion/
[9] https://whitepapers.theregister.com/
The iPhone giant's [1]security bulletins note that the three flaws discovered and reported by Project Zero – CVE-2020-27930 (remote-code execution), CVE-2020-27950 (kernel memory leak), and CVE-2020-27932 (kernel privilege-escalation) – are being actively exploited in the wild.
CVE-2020-27930 is a bug in Apple's font parser that can be exploited by a specially crafted font to achieve arbitrary code execution. CVE-2020-27950 covers a bug that allows a malicious application to disclose kernel memory. CVE-2020-27950 provides a way for a malicious application to run arbitrary code with kernel privileges.
You can probably imagine how these can be chained together to hijack someone's device: get them to open a document, message, or webpage that loads in a maliciously crafted font, which is parsed and triggers code execution with kernel privileges and silently commandeers the handheld.
Apple also issued a security update for tvOS, though that upgrade doesn't cover these three CVEs.
Here's a neat exploit to trick someone into inadvertently emailing their files to you from their Mac, iPhone via Safari [2]READ MORE
Via Twitter, Shane Huntley, director of Google's Threat Analysis Group, provided no additional detail beyond [3]stating that the vulnerabilities are being exploited against selected targets though haven't been used for election meddling.
The updates have been designated iOS 14.2 and iPadOS 14.2, watchOS 7.1, macOS 10.15.7, and tvOS 14.2.
Apple also issued iOS 12.4.9 for outdated iPhone models that it no longer supports in current iOS releases, going back to iPhone 5s. Older watchOS releases also saw updates in the form of watchOS 6.2.9 and 5.3.9. This suggests the bugs are serious enough to warrant an exception for unsupported devices.
The [4]iOS 14.2 and iPadOS 14.2 update covers a total of 24 CVEs including the three flagged by Google. Seventeen, including those three, allow arbitrary code execution. But only the Project Zero bugs are said to be under active exploitation.
Which is just as well because CVE-2020-27902, discovered by developer [5]Connor Ford , can be exploited by a "person with physical access to an iOS device ... to access stored passwords without authentication." This is present in the iOS Keyboard software component, and was fixed by improving the code's state machine.
The [6]watchOS 7.1 update cites 18 CVEs.
The [7]macOS 10.15.7 update only includes the three Project Zero bugs.
Next week, Apple is expected to introduce its first Arm-based [8]Apple Silicon notebook, marking a major chip architecture transition for the company. ®
Get our [9]Tech Resources
[1] https://support.apple.com/en-us/HT201222
[2] https://www.theregister.com/2020/08/26/safari_local_file_leak_api/
[3] https://twitter.com/ShaneHuntley/status/1324431104187670529?s=20
[4] https://support.apple.com/en-us/HT211929
[5] https://twitter.com/connorford2
[6] https://support.apple.com/en-us/HT211928
[7] https://support.apple.com/en-us/HT211947
[8] https://www.theregister.com/2020/06/23/apple_armed_for_x86_rebellion/
[9] https://whitepapers.theregister.com/
Security update - shirley not
My iPhone says this update "includes over 100 new emoji, introduces eight new wallpapers, and brings other new enhancements and bug fixes for your iPhone."
The only mention of security is the standard phrase they add to every IOS update: "For information on the security content of Apple software updates, please visit this website: https://support.apple.com/HT201222".
That definitely doesn't sound like a security fix to me. Without the El Reg article, I would have assumed this was an optional update that could be safely ignored.