Apple developers have fixed two zero-day vulnerabilities in iOS, iPadOS, macOS, and the Safari browser that have already been exploited by hackers. The first vulnerability, identified as CVE-2023-28206, is related to an out-of-bounds write to the IOSurfaceAccelerator, which can lead to data corruption, crashes, or code execution. If successfully exploited, this bug could allow attackers to use a malicious application to execute arbitrary code with kernel privileges on target devices.
The second vulnerability (CVE-2023-28205) is a use-after-free issue in WebKit that could lead to data corruption or arbitrary code execution when memory is reused. This vulnerability could be exploited through a hacker-controlled web page and lead to code execution on compromised systems.
Apple has released fixes for these zero-day vulnerabilities in iOS 16.4.1, iPadOS 16.4.1, macOS Ventura 13.3.1, and Safari 16.4.1. Affected devices include the iPhone 8 and newer, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, iPad mini 5th generation and later, and Macs running macOS Ventura.
Google Threat Analysis Group (TAG) and Amnesty International experts reported the discovery of these bugs, but the technical details of the vulnerabilities, as well as the details of the attacks recorded by experts, have not yet been disclosed.