Apple corrige deux nouvelles failles de sécurité sur ses Mac, iPhone et iPad : c'est l'heure de la mise à jour !

Nathan Le Gohlisse

Spécialiste Hardware

04 décembre 2023 à 15h06

Logo à l'arrière du MacBook Pro 16 2023. © Nathan Le Gohlisse pour Clubic

Apple a déployé en fin de semaine dernière une mise à jour de sécurité en urgence. Cette dernière vise à corriger deux failles zero-day qui impactaient tout autant les iPhone… que les iPad et les Mac.

Vingt. En comptant les failles CVE-2023-42916 et CVE-2023-42917, corrigées en fin de semaine dernière par Apple, c'est le nombre total de vulnérabilités de type zero-day que la firme aura été forcée de combler en 2023. Ces deux dernières vulnérabilités, corrigées en urgence, avaient néanmoins la particularité de concerner tout autant les écosystèmes iOS et iPadOS, que macOS… les rendant donc particulièrement critiques.

Deux failles touchant WebKit…

Comme le précise le site spécialisé BleepingComputer, ces deux failles zero-day ont été découvertes dans le moteur de navigation WebKit. Elles permettaient donc aux attaquants potentiels d'accéder à des informations sensibles en exploitant une faiblesse de lecture out-of-bounds. Il leur était alors possible d'exécuter du code sur les appareils vulnérables, grâce à un bug de corruption de mémoire, le tout à l'aide de pages Web vérolées.

Il y a quelques jours, dans un communiqué, Apple indiquait « être au courant d'un rapport selon lequel ce problème aurait pu être exploité avec des versions d'iOS antérieures à iOS 16.7.1. ». Il y avait donc urgence à agir. Et c'est désormais chose faite.

…désormais corrigées

Apple a en effet annoncé avoir déployé des correctifs permettant de renforcer la validation et le verrouillage des données, mais aussi et surtout de combler les deux vulnérabilités décrites plus haut sur les appareils fonctionnant sous iOS 17.1.2, iPadOS 17.1.2 et macOS Sonoma 14.1.2. Notons en outre que la mise à jour déployée par Apple concerne également Safari 17.1.2.

Voici la liste complète des appareils concernés :

iPhone XS et versions ultérieures
iPad Pro 12,9 pouces de 2e génération et ultérieurs ; iPad Pro 10,5 pouces ; iPad Pro 11 pouces de 1re génération et ultérieurs ; iPad Air de 3e génération et ultérieurs ; iPad de 6e génération et ultérieurs ; mais aussi iPad mini de 5e génération et ultérieurs.
Macs fonctionnant sous macOS Monterey, Ventura, Sonoma

Source : BleepingComputer

Nathan Le Gohlisse

Spécialiste Hardware

Passionné de nouvelles technos, d'Histoire et de vieux Rock depuis tout jeune, je suis un PCiste ayant sombré corps et biens dans les délices de macOS. J'aime causer Tech et informatique sur le web, i...

Lire d'autres articles

Commentaires (0)

tfpsly

Des grosses backdoors exploitées sur iPhone depuis au moins 4 ans. Ars Technica – 27 Dec 23 4-year campaign backdoored iPhones using possibly the most advanced exploit ever "Triangulation" infected dozens of iPhones belonging to employees of Moscow-based Kaspersky. Researchers on Wednesday presented intriguing new findings surrounding an attack that over four years backdoored dozens if not thousands of iPhones, many of which belonged to employees of Moscow-based security firm Kaspersky. Chief among the discoveries: the unknown attackers were able to achieve an unprecedented level of access by exploiting a vulnerability in an undocumented hardware feature that few if anyone outside of Apple and chip suppliers such as ARM Holdings knew of. “The exploit’s sophistication and the feature’s obscurity suggest the attackers had advanced technical capabilities,” Kaspersky researcher Boris Larin wrote in an email. “Our analysis hasn’t revealed how they became aware of this feature, but we’re exploring all possibilities, including accidental disclosure in past firmware or source code releases. They may also have stumbled upon it through hardware reverse engineering.” … The most intriguing new detail is the targeting of the heretofore-unknown hardware feature, which proved to be pivotal to the Operation Triangulation campaign. A zero-day in the feature allowed the attackers to bypass advanced hardware-based memory protections designed to safeguard device system integrity even after an attacker gained the ability to tamper with memory of the underlying kernel. On most other platforms, once attackers successfully exploit a kernel vulnerability they have full control of the compromised system. … “This is no ordinary vulnerability,” Larin said in a press release that coincided with a presentation he made at the 37th Chaos Communication Congress in Hamburg, Germany. “Due to the closed nature of the iOS ecosystem, the discovery process was both challenging and time-consuming, requiring a comprehensive understanding of both hardware and software architectures. What this discovery teaches us once again is that even advanced hardware-based protections can be rendered ineffective in the face of a sophisticated attacker, particularly when there are hardware features allowing to bypass these protections.” . In a research paper also published Wednesday, Larin added: If we try to describe this feature and how attackers use it, it all comes down to this: attackers are able to write the desired data to the desired physical address with [the] bypass of [a] hardware-based memory protection by writing the data, destination address and hash of data to unknown, not used by the firmware, hardware registers of the chip. Our guess is that this unknown hardware feature was most likely intended to be used for debugging or testing purposes by Apple engineers or the factory, or was included by mistake. Since this feature is not used by the firmware, we have no idea how attackers would know how to use it … image1280×720 114 KB Kaspersky’s summary of the exploit chain is: Attackers send a malicious iMessage attachment, which is processed by the application without showing any signs to the user This attachment exploits vulnerability CVE-2023-41990 in the undocumented, Apple-only TrueType font instruction ADJUST for a remote code execution. This instruction existed since the early 90’s and the patch removed it. It uses return/jump oriented programming, multiple stages written in NSExpression/NSPredicate query language, patching JavaScriptCore library environment to execute a privilege escalation exploit written in JavaScript. This JavaScript exploit is obfuscated to make it completely unreadable and to minimize its size. Still it has around 11000 lines of code which are mainly dedicated to JavaScriptCore and kernel memory parsing and manipulation. It’s exploited JavaScriptCore’s debugging feature DollarVM ($vm) to get the ability to manipulate JavaScriptCore’s memory from the script and execute native API functions. It was designed to support old and new iPhones and included a Pointer Authentication Code (PAC) bypass for exploitation of newer models. It used an integer overflow vulnerability CVE-2023-32434 in the XNU’s memory mapping syscalls (mach_make_memory_entry and vm_map) to get read/write access to [the] whole physical memory of the device from the user level. It uses hardware memory-mapped I/O (MMIO) registers to bypass Page Protection Layer (PPL). This was mitigated as CVE-2023-38606. After exploiting all the vulnerabilities, the JavaScript exploit can do whatever it wants to the device and run spyware, but attackers chose to: a) launch the imagent process and inject a payload that cleans the exploitation artifacts from the device; b) run the Safari process in invisible mode and forward it to the web page with the next stage. Web page has the script that verifies the victim and, if the checks pass, it receives the next stage—the Safari exploit. Safari exploit uses vulnerability CVE-2023-32435 to execute a shellcode. Shellcode executes another kernel exploit in the form of mach object file. It uses the same vulnerabilities CVE-2023-32434 and CVE-2023-38606, it’s also massive in size and functionality, but it is completely different from the kernel exploit written in JavaScript. Only some parts related to exploitation of the above-mentioned vulnerabilities are the same. Still most of its code is also dedicated to the parsing and manipulation of the kernel memory. It has various post-exploitation utilities, which are mostly unused. Exploit gets root privileges and proceeds to execute other stages responsible for loading of spyware. We already covered these stages in our previous posts. …

Apple corrige deux nouvelles failles de sécurité sur ses Mac, iPhone et iPad : c'est l'heure de la mise à jour !

Deux failles touchant WebKit…

…désormais corrigées

A découvrir en vidéo

Commentaires (0)

Top app & logiciels

Sur le même sujet