Apple has released nine security updates to address vulnerabilities in multiple products. Apple is reporting exploitation of CVE-2022-42856, which impacts iOS, iPadOS, Safari, tvOS, and macOS Ventura. A remote attacker could exploit some of these vulnerabilities to take control of a vulnerable system.

Exploitation and Proof-of-Concept reported for multiple vulnerabilities

Apple has released a new security update to resolve an exploited vulnerability tracked as CVE-2022-42856 and within iOS, iPadOS, Safari, tvOS, and macOS Ventura. The vulnerability could allow an attacker to execute arbitrary code on the device after processing maliciously crafted web content. This vulnerability could enable an attacker to execute malicious code on the device or to corrupt sensitive data.

Microsoft Security Vulnerability Research team has released a proof-of-concept for CVE-2022-42821 which they have called "Achilles". The vulnerability could allow attackers to bypass application execution restrictions imposed by Apple’s Gatekeeper security mechanism, designed to ensure only trusted apps run on Mac devices.

A proof-of-concept has been released for CVE-2022-46689 and there have been reports of active exploitation in the wild. CVE-2022-46689 a race condition vulnerability that could allow a malicious app to execute arbitrary code with kernel privileges.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2022-48168 to their Known Exploited Vulnerability Catalog based on evidence of active exploitation in the wild.

Threat updates

Date	Update
1 Feb 2024	Active exploitation of CVE-2022-48618 This article has been updated to reflect this change in the status of exploitation.
10 Feb 2023	Exploitation and Proof-of-Concept reported for CVE-2022-46689 This article has been updated to reflect this change in the status of exploitation.
20 Dec 2022	Microsoft Releases Proof-of-Concept for CVE-2022-42821 Microsoft Security Vulnerability Research team has released a proof-of-concept for CVE-2022-42821 which they have called "Achilles". This article has been updated to reflect those changes.

Remediation advice

Affected organisations are encouraged to review the following Apple security advisories and apply any relevant updates or workarounds.

Remediation steps

Type	Step
Patch	iCloud for Windows 14.1 \| HT213538 https://support.apple.com/en-us/HT213538
Patch	Safari 16.2 \| HT213537 https://support.apple.com/en-us/HT213537
Patch	macOS Monterey 12.6.2 \| HT213533 https://support.apple.com/en-us/HT213533
Patch	macOS Big Sur 11.7.2 \| HT213534 https://support.apple.com/en-us/HT213534
Patch	tvOS 16.2 \| HT213535 https://support.apple.com/en-us/HT213535
Patch	watchOS 9.2 \| HT213536 https://support.apple.com/en-us/HT213536
Patch	iOS 15.7.2 and iPadOS 15.7.2 \| HT213531 https://support.apple.com/en-us/HT213531
Patch	iOS 16.2 and iPadOS 16.2 \| HT213530 https://support.apple.com/en-us/HT213530
Patch	macOS Ventura 13.1 \| HT213532 https://support.apple.com/en-us/HT213532

Definitive source of threat updates

https://support.apple.com/en-us/HT201222

CVE Vulnerabilities

Status Published

CVE-2022-46689

A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.

Status Published

CVE-2022-42856

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..

Status Published

CVE-2022-40303

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

Status Published

CVE-2022-40304

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

Status Published

CVE-2022-42821

A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Big Sur 11.7.2, macOS Ventura 13. An app may bypass Gatekeeper checks.

Last edited: 1 February 2024 1:29 pm