7 ms·

Apple releases macOS 12.5.1, iOS 15.6.1, patches for two zero-day vulerabilities

188 points by nateb2022 4y ago

samtheprogram 4y ago
Interesting there’s no release for other “supported” versions of macOS. Seems this just affects Monterrey and the associated versions of iOS?
- Klonoar 4y ago
  Came here to ask - there's really no patch for Big Sur?
  - radicaldreamer 4y ago
    They might still be working on it
    - gumby 4y ago
      Or the vulnerability might apply only to a more modern feature.
egypturnash 4y ago
Link is to the macOS patch notes, https://support.apple.com/en-us/HT213412 https://support.apple.com/en-us/HT213412 is the patch notes for iOS if anyone's curious. The only difference is "available for a bunch of iThings" instead of "available for Monterey", the CVEs are the same.
dieulot 4y ago
> WebKit Bugzilla: 243557 https://bugs.webkit.org/show_bug.cgi?id=243557 https://bugs.webkit.org/show_bug.cgi?id=243557 (leading to https://github.com/WebKit/WebKit/commit/1ed1e4a336e15a59b94a21b0300658e2f7dc9fef https://github.com/WebKit/WebKit/commit/1ed1e4a336e15a59b94a...) Shouldn’t this issue have been made inaccessible in order to mitigate exploitation?
- cjbprime 4y ago
  The bug doesn't seem to describe the vulnerability at all, though?
  - sammoody 4y ago
    When making security patches it’s often best to leave those details out, as otherwise it’s used as a guide for bad actors
    - hulitu 4y ago
      The bad actors already exploit them.
      - dotty- 4y ago
        The really good bad actors already exploit them. The eager bad actors with less skills look for guides.
      - dymk 4y ago
        How do you know every bad actor already knows how to exploit it?
- dandongus 4y ago
  Not sure why people flagged you for this. It's very common for open source projects to make the details of security-related bugs private. One example is Firefox, nearly every security update references one or more bug tickets that the public doesn't have permission to view. I wonder if Apple listed the wrong webkit bug number, it almost looks like it.
  - tposx 4y ago
    Looks like the vulnerability was something to do with incorrect JIT optimisations on Maps and Sets, if the included tests are any indication.
- 4y ago
Syonyk 4y ago
I haven't seen a good answer to the question, "Does Lockdown on iOS 16 prevent whatever this exploited?" In any case, there was a Chrome 0day recently patched too, an Element Desktop RCE... so... Qubes is looking less and less like "A good idea" and more and more like "The only way to safely use web browsers." :( Disposable browsing VMs should keep the nasties away.
- antegamisou 4y ago
  > Qubes is looking less and less like "A good idea" and more and more like "The only way to safely use web browsers." That is until someone comes up with a debilitating Xen 0-day
  - Syonyk 4y ago
    > That is until someone comes up with a debilitating Xen 0-day But you're adding layers. A Xen 0day, alone, isn't useful. You have to be able to deliver it, which probably implies local root. To get something useful out of a user's home directory on a typical OS install, you pop the browser, do what you want. To get something useful out of a user in Qubes, assuming they're using an untrusted browsing VM, you have to pop the browser, then get local root, then deploy your Xen exploit... and then maybe do something useful. There's also the standard malware anti-RE-sandbox techniques used. Show up in a clean profile on a hypervisor? Maaaaaybe not a good idea to be evil. Lots of stuff will refuse to actuate in something that looks like a malware RE sandbox, and a disposable Qubes VM certainly would look like that. I won't claim it's impossible, but I will claim that doing a cross-Qube hop through Xen is a lot harder than just one exploit and get the goodies.
    - GauntletWizard 4y ago
      You have to pop the browser, then export their password keychain, because who's going to do run a bazillion copies of Chrome to separate them by site
    - Qualadore 4y ago
      > then get local root With Qubes you already by default have local root [0], because LPE is usually almost a forgone conclusion if the attacker has a sandbox escape. > A Xen 0day, alone, isn't useful. I don't think there any attackers with the interest and capability to acquire a Xen sandbox escape that wouldn't readily have access to browser 0-days, unless the target is using something like Tor Browser Bundle with JS, SVG, and PDF.js disabled. [0] https://www.qubes-os.org/doc/vm-sudo/ https://www.qubes-os.org/doc/vm-sudo/
deleted 4y ago
[deleted]
roog 4y ago
- nojito 4y ago
  What? This isn’t true at all. Many people just prefer to do their work anonymously. https://support.apple.com/en-us/HT213346 https://support.apple.com/en-us/HT213346 Here’s a neural engine bug where one researcher was anonymous and the other wasn’t.
  - tbrock 4y ago
    Both statements can be true, it’s a hallmark of nation states and humble anonymous researchers.
    - deleted 4y ago
      [deleted]
  - vardump 4y ago
    Indeed. Exploit researchers themselves are quickly top priority targets. Understandable if someone wants to remain anonymous.
- chrisseaton 4y ago
  > That's the hallmark of a nation state that has previously been exploiting these, but since decided - for whatever reason - that the vulns have become too risky to leave undisclosed to the vendor. I think it just means the person doesn’t want to be named.
  - smiddereens 4y ago
panny 4y ago
Why isn't there basic information available on this cve? What version range is affected? What applications or system utilities are affected? Is it remotely exploitable or local only? Does it require elevated privileges? This is the level of support you get from a trillion dollar company?
- pinewurst 4y ago
  How much support do you get from Google on Android issues? Or any issue? Or anything, really?
  - olyjohn 4y ago
    This thread isn't about Google or Android. So stop with the what about this and that crap. What they do doesn't excuse Apple anyways.
    - ribosometronome 4y ago
      Generally agree that whataboutism is often unhelpful and how Google operates doesn't excuse Apple but that's not what was asked. The question was "This is the level of support you get from a trillion dollar company?", so someone coming in and pointing out that it's the same or worse at other trillion dollar companies is answering the question.
  - murderfs 4y ago
    The Android security bulletins are pretty straightforward and include links to the actual patches: https://source.android.com/docs/security/bulletin/2022-07-01#framework https://source.android.com/docs/security/bulletin/2022-07-01...
- tinus_hn 4y ago
  The level of support is: install this update if you want to be secure. The idea is that you don’t need to know all that other information. Install the update to be secure.
yborg 4y ago
Wow, what was that...? Rebooted my Intel Mini like 4 times and took a good 20 minutes to apply a point release.
- icedchai 4y ago
  Does anyone know why macOS updates seemingly take forever? Even on the fastest Macs available, they are slow.
  - r618 4y ago
    APFS can't do incremental updates, they need to always replace the whole snapshot I won't give exact technical reasons, but each update since APFS was made default is few GBs
  - dandongus 4y ago
    From a purely anecdotal perspective, I've noticed a vast decrease in the performance of the macOS updaters/installers since the point when they switched to using what is essentially the iOS mechanism for them, with the MobileAsset UpdateBrain stuff, and .ipsw files, and chunked pbzx archives nested inside zip archives nested inside xar archives. I don't remember the details of the previous system, but I remember it seeming a lot simpler, a lot less buggy, and certainly a lot faster on my hardware.
    - sneak 4y ago
      The "brain" to which it refers (on x64 machines) basically is an iOS device (running a variant called bridgeOS) on an ARM coprocessor (T2) inside your computer. Same secure boot, same TSS signatures, etc. It has to update two OSes now, not just one.
      - radicaldreamer 4y ago
        Even the new studio display is an iOS device and also takes forever to update.
joshmarinacci 4y ago
Can we please stop writing code in languages that allow buffer overflows? Please?!
- chris_wot 4y ago
  Sure, let's go rewrite millions and millions of lines of functioning code. Want to volunteer?
  - Gigachad 4y ago
    Yes, at this point I'd probably only start taking jobs in secure languages. Working on Rust web services has been a joy and I don't know if I could stand going back to insecure languages and finding critical issues out in the wild like this.
    - rrdharan 4y ago
      Just because you happened to write and deploy your app in Rust doesn’t protect you from critical issues in the wild: https://internals.rust-lang.org/t/spectre-mitigations-in-rust/13353 https://internals.rust-lang.org/t/spectre-mitigations-in-rus...
      - Gigachad 4y ago
        My seat belt also doesn't stop me dying in a car crash but I still put it on and disregard anyone telling me I shouldn't bother because its not perfect.
        rrdharan 4y ago
        Sure, but that's not what I (or the sibling commenter) was saying. I'm a proponent of using more secure languages, my point is just that if you think it will mean a world in which you won't be "finding critical issues out in the wild like this", you're wrong. There will always be 0days; attackers will always find a way.
    - 4y ago
gennarro 4y ago
FYI the cve is https://exploit.report/cve/CVE-2022-32894/ https://exploit.report/cve/CVE-2022-32894/ not https://exploit.report/cve/cve-2022-30293/ https://exploit.report/cve/cve-2022-30293/ Hopefully more info will drop soon.
deleted 4y ago
[deleted]
nr2x 4y ago
“Out of bounds write” means buffer overflow?
- Someone 4y ago
  I would interpret that as more generic than buffer overflow. “Buffer overflow”, for me, is for when you read or write a short distance before or after a buffer (typically because your looping over it and got your ending condition wrong). “Out of bounds write”, for me, also includes when you read or write basically anywhere (say a function you call overwrites your local pointer to a buffer with ‘random’ bits, and you then use the corrupted pointer to read or write data)
  - nr2x 4y ago
    Gotcha, thanks.
can16358p 4y ago
Went to software update on my iPhone, it told 15.6.1 available as a security update, started downloading, it said 1 minute left. For some reason it said an error occured when I went back to settings. And now, for the same 15.6.1's description it says: "This update adds the ability to unlock with Face ID while wearing a mask on iPhone 12 and newer. This update also includes new emoji, a new voice option for Siri, and other features and bug fixes for your iPhone. Some features may not be available for all regions or on all Apple devices. For information on the security content of Apple software updates, please visit this website: https://support.apple.com/kb/HT201222 https://support.apple.com/kb/HT201222" And it now says 45 minutes left. I'm already on 15.6 so the Face ID/Emoji is irrelevant since I already have them being 15.6, and it didn't say any of it when it first showed 15.6.1 as an update anyway. Trying to make sense of the whole thing.
- neilalexander 4y ago
  My iPad did the same. I assume it failed to download the delta update (200MB-ish) for some reason and therefore defaulted back to downloading the full restore image (5GB-ish) instead which must have had different release notes. It installed fine after doing so though.

188 points by nateb2022 4y ago

Interesting there’s no release for other “supported” versions of macOS. Seems this just affects Monterrey and the associated versions of iOS?

Klonoar 4y ago
Came here to ask - there's really no patch for Big Sur?
- radicaldreamer 4y ago
  They might still be working on it
  - gumby 4y ago
    Or the vulnerability might apply only to a more modern feature.

egypturnash 4y ago

Link is to the macOS patch notes, https://support.apple.com/en-us/HT213412 https://support.apple.com/en-us/HT213412 is the patch notes for iOS if anyone's curious. The only difference is "available for a bunch of iThings" instead of "available for Monterey", the CVEs are the same.

dieulot 4y ago

> WebKit Bugzilla: 243557 https://bugs.webkit.org/show_bug.cgi?id=243557 https://bugs.webkit.org/show_bug.cgi?id=243557 (leading to https://github.com/WebKit/WebKit/commit/1ed1e4a336e15a59b94a21b0300658e2f7dc9fef https://github.com/WebKit/WebKit/commit/1ed1e4a336e15a59b94a...) Shouldn’t this issue have been made inaccessible in order to mitigate exploitation?

cjbprime 4y ago
The bug doesn't seem to describe the vulnerability at all, though?
- sammoody 4y ago
  When making security patches it’s often best to leave those details out, as otherwise it’s used as a guide for bad actors
  - hulitu 4y ago
    The bad actors already exploit them.
    - dotty- 4y ago
      The really good bad actors already exploit them. The eager bad actors with less skills look for guides.
    - dymk 4y ago
      How do you know every bad actor already knows how to exploit it?
dandongus 4y ago
Not sure why people flagged you for this. It's very common for open source projects to make the details of security-related bugs private. One example is Firefox, nearly every security update references one or more bug tickets that the public doesn't have permission to view. I wonder if Apple listed the wrong webkit bug number, it almost looks like it.
- tposx 4y ago
  Looks like the vulnerability was something to do with incorrect JIT optimisations on Maps and Sets, if the included tests are any indication.
4y ago

Syonyk 4y ago

I haven't seen a good answer to the question, "Does Lockdown on iOS 16 prevent whatever this exploited?" In any case, there was a Chrome 0day recently patched too, an Element Desktop RCE... so... Qubes is looking less and less like "A good idea" and more and more like "The only way to safely use web browsers." :( Disposable browsing VMs should keep the nasties away.

antegamisou 4y ago
> Qubes is looking less and less like "A good idea" and more and more like "The only way to safely use web browsers." That is until someone comes up with a debilitating Xen 0-day
- Syonyk 4y ago
  > That is until someone comes up with a debilitating Xen 0-day But you're adding layers. A Xen 0day, alone, isn't useful. You have to be able to deliver it, which probably implies local root. To get something useful out of a user's home directory on a typical OS install, you pop the browser, do what you want. To get something useful out of a user in Qubes, assuming they're using an untrusted browsing VM, you have to pop the browser, then get local root, then deploy your Xen exploit... and then maybe do something useful. There's also the standard malware anti-RE-sandbox techniques used. Show up in a clean profile on a hypervisor? Maaaaaybe not a good idea to be evil. Lots of stuff will refuse to actuate in something that looks like a malware RE sandbox, and a disposable Qubes VM certainly would look like that. I won't claim it's impossible, but I will claim that doing a cross-Qube hop through Xen is a lot harder than just one exploit and get the goodies.
  - GauntletWizard 4y ago
    You have to pop the browser, then export their password keychain, because who's going to do run a bazillion copies of Chrome to separate them by site
  - Qualadore 4y ago
    > then get local root With Qubes you already by default have local root [0], because LPE is usually almost a forgone conclusion if the attacker has a sandbox escape. > A Xen 0day, alone, isn't useful. I don't think there any attackers with the interest and capability to acquire a Xen sandbox escape that wouldn't readily have access to browser 0-days, unless the target is using something like Tor Browser Bundle with JS, SVG, and PDF.js disabled. [0] https://www.qubes-os.org/doc/vm-sudo/ https://www.qubes-os.org/doc/vm-sudo/

deleted 4y ago

[deleted]

roog 4y ago

nojito 4y ago
What? This isn’t true at all. Many people just prefer to do their work anonymously. https://support.apple.com/en-us/HT213346 https://support.apple.com/en-us/HT213346 Here’s a neural engine bug where one researcher was anonymous and the other wasn’t.
- tbrock 4y ago
  Both statements can be true, it’s a hallmark of nation states and humble anonymous researchers.
  - deleted 4y ago
    [deleted]
- vardump 4y ago
  Indeed. Exploit researchers themselves are quickly top priority targets. Understandable if someone wants to remain anonymous.
chrisseaton 4y ago
> That's the hallmark of a nation state that has previously been exploiting these, but since decided - for whatever reason - that the vulns have become too risky to leave undisclosed to the vendor. I think it just means the person doesn’t want to be named.
- smiddereens 4y ago

panny 4y ago

Why isn't there basic information available on this cve? What version range is affected? What applications or system utilities are affected? Is it remotely exploitable or local only? Does it require elevated privileges? This is the level of support you get from a trillion dollar company?

pinewurst 4y ago
How much support do you get from Google on Android issues? Or any issue? Or anything, really?
- olyjohn 4y ago
  This thread isn't about Google or Android. So stop with the what about this and that crap. What they do doesn't excuse Apple anyways.
  - ribosometronome 4y ago
    Generally agree that whataboutism is often unhelpful and how Google operates doesn't excuse Apple but that's not what was asked. The question was "This is the level of support you get from a trillion dollar company?", so someone coming in and pointing out that it's the same or worse at other trillion dollar companies is answering the question.
- murderfs 4y ago
  The Android security bulletins are pretty straightforward and include links to the actual patches: https://source.android.com/docs/security/bulletin/2022-07-01#framework https://source.android.com/docs/security/bulletin/2022-07-01...
tinus_hn 4y ago
The level of support is: install this update if you want to be secure. The idea is that you don’t need to know all that other information. Install the update to be secure.

yborg 4y ago

Wow, what was that...? Rebooted my Intel Mini like 4 times and took a good 20 minutes to apply a point release.

icedchai 4y ago
Does anyone know why macOS updates seemingly take forever? Even on the fastest Macs available, they are slow.
- r618 4y ago
  APFS can't do incremental updates, they need to always replace the whole snapshot I won't give exact technical reasons, but each update since APFS was made default is few GBs
- dandongus 4y ago
  From a purely anecdotal perspective, I've noticed a vast decrease in the performance of the macOS updaters/installers since the point when they switched to using what is essentially the iOS mechanism for them, with the MobileAsset UpdateBrain stuff, and .ipsw files, and chunked pbzx archives nested inside zip archives nested inside xar archives. I don't remember the details of the previous system, but I remember it seeming a lot simpler, a lot less buggy, and certainly a lot faster on my hardware.
  - sneak 4y ago
    The "brain" to which it refers (on x64 machines) basically is an iOS device (running a variant called bridgeOS) on an ARM coprocessor (T2) inside your computer. Same secure boot, same TSS signatures, etc. It has to update two OSes now, not just one.
    - radicaldreamer 4y ago
      Even the new studio display is an iOS device and also takes forever to update.

joshmarinacci 4y ago

Can we please stop writing code in languages that allow buffer overflows? Please?!

chris_wot 4y ago
Sure, let's go rewrite millions and millions of lines of functioning code. Want to volunteer?
- Gigachad 4y ago
  Yes, at this point I'd probably only start taking jobs in secure languages. Working on Rust web services has been a joy and I don't know if I could stand going back to insecure languages and finding critical issues out in the wild like this.
  - rrdharan 4y ago
    Just because you happened to write and deploy your app in Rust doesn’t protect you from critical issues in the wild: https://internals.rust-lang.org/t/spectre-mitigations-in-rust/13353 https://internals.rust-lang.org/t/spectre-mitigations-in-rus...
    - Gigachad 4y ago
      My seat belt also doesn't stop me dying in a car crash but I still put it on and disregard anyone telling me I shouldn't bother because its not perfect.
      - rrdharan 4y ago
        Sure, but that's not what I (or the sibling commenter) was saying. I'm a proponent of using more secure languages, my point is just that if you think it will mean a world in which you won't be "finding critical issues out in the wild like this", you're wrong. There will always be 0days; attackers will always find a way.
  - 4y ago

gennarro 4y ago

FYI the cve is https://exploit.report/cve/CVE-2022-32894/ https://exploit.report/cve/CVE-2022-32894/ not https://exploit.report/cve/cve-2022-30293/ https://exploit.report/cve/cve-2022-30293/ Hopefully more info will drop soon.

deleted 4y ago

[deleted]

nr2x 4y ago

“Out of bounds write” means buffer overflow?

Someone 4y ago
I would interpret that as more generic than buffer overflow. “Buffer overflow”, for me, is for when you read or write a short distance before or after a buffer (typically because your looping over it and got your ending condition wrong). “Out of bounds write”, for me, also includes when you read or write basically anywhere (say a function you call overwrites your local pointer to a buffer with ‘random’ bits, and you then use the corrupted pointer to read or write data)
- nr2x 4y ago
  Gotcha, thanks.

can16358p 4y ago

Went to software update on my iPhone, it told 15.6.1 available as a security update, started downloading, it said 1 minute left. For some reason it said an error occured when I went back to settings. And now, for the same 15.6.1's description it says: "This update adds the ability to unlock with Face ID while wearing a mask on iPhone 12 and newer. This update also includes new emoji, a new voice option for Siri, and other features and bug fixes for your iPhone. Some features may not be available for all regions or on all Apple devices. For information on the security content of Apple software updates, please visit this website: https://support.apple.com/kb/HT201222 https://support.apple.com/kb/HT201222" And it now says 45 minutes left. I'm already on 15.6 so the Face ID/Emoji is irrelevant since I already have them being 15.6, and it didn't say any of it when it first showed 15.6.1 as an update anyway. Trying to make sense of the whole thing.

neilalexander 4y ago
My iPad did the same. I assume it failed to download the delta update (200MB-ish) for some reason and therefore defaulted back to downloading the full restore image (5GB-ish) instead which must have had different release notes. It installed fine after doing so though.