Luckily, these updates are never too far behind, but must be installed immediately to take effect.(Bloomberg) - Apple Inc. Threat actors constantly tailor their attacks to any given vulnerability. “Many people often feel overwhelmed by the quantity of updates sent by Apple and Android, but these are for the benefit of the device and the owner. When Apple pushes out a fix in a patch, it is vital that users update at the earliest convenience and do not procrastinate. If you do not have automatic updates turned on, you should do this today, as ESET’s Jake Moore said: “When such flaws are located in the wild, it is a race against time for those looking to find a solution. The new patched version of macOS Monterey is 12.3.1, and the patched version of iOS and iPadOS is 15.4.1. This is because if they can access the kernel, a malicious actor “pretty much has access-all-areas privileges” on the target device, which in a worst-case scenario would enable them to take full control of it, he said.īearing in mind that Apple devices are capable of taking such updates automatically, and, as such, many will have already received the patches, users can check their update status and download them by going to Apple Menu – About this Mac – Software Update on a Mac, or Settings – General – Software Update on an iPhone or iPad.

Sophos’s Paul Ducklin said such kernel vulnerabilities were, broadly speaking, some of the more potentially dangerous issues that could impact Apple devices.

This vulnerability is an out-of-bounds write issue that, if exploited, enables an application to execute arbitrary code with kernel privileges.

It is an out-of-bounds read issue that, if exploited, leads to the disclosure of kernel memory.ĬVE-2022-22675 exists in the AppleAVD audio and video decoding framework for macOS Monterey, iPhone 6s and later, all models of iPad Pro, iPad Air 2 and later, iPad fifth generation and later, iPad Mini 4 and later, and iPod Touch seventh generation. They are the fourth and fifth zero-days found in Apple kit this year to date.ĬVE-2022-22674 exists in the Intel Graphics Driver and is patched in macOS Monterey only. Disclosed by an anonymous security researcher, the vulnerabilities are being tracked as CVE-2022-22674 and CVE-22675, respectively.

Apple emergency update