Do you know what a Zero-Day exploit is?

If you're not familiar with the term, a Zero-Day exploit is a security flaw that the software vendor is not aware of and hasn't yet patched.

In many (but not all) cases, Zero-Day Vulnerabilities will also have publicly available proof-of-concept exploits before a patch becomes available.  Quite often, these flaws are being actively exploited in the wild.

Apple has recently released a security update to address one of these types of flaws that impact Macs and Apple Watches.

In this case, the flaw in question is tracked as CVE-2022-22675. It is an out-of-bounds write issue that allows apps to execute arbitrary code.  That's bad enough all by itself, but in this case, it allows an attacker to execute that code with kernel level privileges.

The flaw impacts all macOS Big Sur versions before 11.6 and tvOS devices before 15.5.

So far in 2022, Apple has released security patches addressing five different Zero Day exploits.

 

Here's a quick summary of these issues

  • CVE-2022-22587, which allowed attackers to track user IDs and web browsing activity in real time
  • CVE-2022-22594, which did the same thing as above
  • Then, CVE-2022-22620 was discovered and addressed, which is an exploit used to hack iPads, iPhones, and Macs. This exploit allowed remote code execution and can cause OS crashes
  • And in March 2022, two other exploits were addressed. The first, tracked as CVE-2022-22674, is a flaw impacting the Intel Graphics Driver and the second, tracked as CVE-2022-22675, impacted the AppleAVD media decoder.

These five join a long list of Zero-Day exploits the company patched in 2021 that targeted iOS, iPadOS, and macOS devices.

 

My perspective

Kudos to the company for their fast action on the Zero-Day front, although the pace of discovery of these types of exploits is distressing to say the least.

In any case, if you own a Mac or an Apple device that uses tvOS, be sure you patch to the latest version right away to minimize your risk.

 

"Terminate, with extreme prejudice" - Colonel Lucas in Apocalypse Now

 


By Denis Wilson

Cybersecurity Expert, Small Business Technology Consultant, Managed Services Provider, Managed IT Support

Thanks for reading this post. I always take into mind that your time and attention are precious. And these posts need to be timely, to the point, and short.

For more tips on thriving with small business technology, check out the other blog posts at DWPIA Blogs. You can also find me on LinkedIn, Facebook, and Twitter

I am also a published author and speaker on cloud computing, work-at-home, and cybersecurity. I work extensively with business and professional associations to provide free small business technology education programs.

 

Contact me if you would like me to speak to your association