Apple reveals two zero-day vulnerabilities in iOS

The most recent security update for iOS 17.4 and iPadOS 17.4 includes patches for two zero-day vulnerabilities, CVE-2024-23225 and CVE-2024-23296, which Apple revealed and made available. A "memory corruption issue" impacting the kernel is known as CVE-2024-23225. According to Apple, "an attacker with arbitrary kernel read and writes capability may be able to bypass kernel memory protections." Similar details can be found in CVE-2024-23296, however it is unique to RTKit, the operating system found in the majority of Apple processors, peripherals, and embedded devices.

Both flaws affect the following devices:

iPhone XS and later.

iPad Pro 12.9-inch 2nd generation and later.

iPad Pro 10.5-inch.

iPad Pro 11-inch 1st generation and later.

iPad Air 3rd generation and later.

iPad 6th generation and later.

iPad mini 5th generation and later.

Apple did not provide further details in the disclosure or credit specific researchers in the security advisory. Apple only noted in both cases that the vulnerabilities "may have been exploited" in the wild and that both issues were addressed via "improved validation." Neither vulnerability has been designated a CVSS score at press time.

In a post to X, Kaspersky noted that the flaws' capability to bypass kernel memory protections "appears to be a direct path to privilege escalation." The antivirus vendor also said the lack of credited researchers "may suggest an ongoing investigation." Kaspersky recommended that all iOS users update as soon as possible.

CVE-2024-23225 and CVE-2024-23296 mark the second and third zero-days Apple has addressed this year. The first came in January: CVE-2024-23222, which Apple addressed in a similar update. CVE-2024-23222 is a type confusion issue in WebKit that Apple described by saying that "Processing maliciously crafted web content may lead to arbitrary code execution."

Apple has disclosed a litany of zero-day flaws in recent years, many of which have been connected to exploits used by the commercial spyware industry.