… Apple continues shipping security patches for iPhones, iPads, and Macs released more than a decade ago even after those devices fall behind the newest operating systems. Current-generation operating systems received the largest security patches in the release cycle. …
… The latter includes over 75 security enhancements, 14 of which address kernel-related vulnerabilities. 10 of the now-patched kernel issues allowed apps to trigger unexpected system terminations, while others let apps access sensitive user data and write kernel memory. …
… Manifesting as malicious content opened in Safari, it can lead to full kernel control and complete access to data stored on the iPhone. …
… The mechanics of the attack consist of the user opening malicious web content in Safari, which leads to full kernel control. …
… Timeline of DarkSword observations and vulnerability patches. …
… The CVE-2023-41974 targeted a kernel vulnerability, while CVE-2024-23222, CVE-2023-43000, and the same CVE-2023-43010 cover WebKit. Apple also released iPadOS 15.8.7 and iPadOS 16.7.15 to address the same vulnerabilities. …
… The researchers claim their exploit chain survived MIE protections on bare-metal M5 hardware with kernel MIE enabled. The attack is the first public macOS kernel memory corruption exploit demonstrated against Apple& 039;s new MIE hardware protections, according to the team. …
… While Mac OS X 10.0 Cheetah might not be many people& 039;s go-to releases, there& 039;s a reason it was chosen. …