Apple have released eight security updates this week for a range of devices. Four of these updates include fixes for a zero-day vulnerability in AppleAVD. This vulnerability is said to have been actively exploited before this update was released, and affected Apple Watch, Apple TV, Macs, iPhones and iPads.
Identified as CVE-2022-22675 by an anonymous researcher, the AppleAVD vulnerability allowed for an application to execute arbitrary code with kernel privileges. This is due to an out of bounds issue on AppleAVD, a kernel extension for audio and video decoding. The recent update has addressed this through improved bound checking on iOS 15.4.1, iPadOS 15.4.1, macOS Big Sur, tvOS 15.5 and watchOS 8.6.
Apple does not confirm security issues until updates or patches are readily available, in order to protect customers, so that malicious actors cannot take advantage of known and publicised vulnerabilities before fixes are released. It is therefore best practice to update affected devices immediately when patches are released, before attackers can take advantage of the released details. It is thought that this AppleAVD vulnerability was used in targeted attacks only, however the update should still be applied in order to prevent any further attack attempts.
Another notable fix from the updates released this week include multiple issues in Apache being patched for Macs. The affected systems were macOS Monetrey 12.4, macOS Catalina 2022-004, and macOS Big Sur 11.6.6.
These identified issues are:
- CVE-2021-44224
NULL Pointer Dereference – URI sent to httpd as forward proxy can cause a crash.
- CVE-2021-44790
Out-of-bounds write can cause an overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts)
- CVE-2022-22719
Improper initialisation can cause a read to a random memory area causing the process to crash.
- CVE-2022-22720
HTTP request smuggling through inconsistent interpretation of requests.
- CVE-2022-22721
Integer overflow when LimitXMLRequestBody set to allow request bodies larger than 350MB on 32 bit systems, causing out-of-bounds writes.
The update this week addressed these by moving Apache to version 2.4.53. This update is essential as although the Apache httpd team have stated they are not currently aware of an exploit for the CVE-2021-44790 vulnerability, they expect it might be possible to craft one.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)