iOS 15.7.2 and iPadOS 15.7.2: Essential Security Updates You Need to Know

Keeping your Apple devices secure is paramount in today’s digital landscape. Apple regularly releases updates to protect users from emerging threats and vulnerabilities. iOS 15.7.2 and iPadOS 15.7.2 are crucial updates that address a range of security issues across various components of your iPhone, iPad, and iPod touch. This document breaks down the security content of these updates, helping you understand the importance of keeping your devices up to date.

Understanding Apple Security Updates

Apple prioritizes user security and employs a policy of not disclosing, discussing, or confirming security vulnerabilities until a thorough investigation has been conducted and patches or updates are readily available. This practice ensures that malicious actors are not alerted to potential exploits before users are protected. You can find a list of recent security releases on the Apple security updates page.

For technical references, Apple security documents often use CVE-ID to catalog vulnerabilities. This standardized system allows security professionals to easily identify and discuss specific security issues.

For more general information about Apple’s commitment to security, you can visit the Apple Product Security page.

Detailed Breakdown of iOS 15.7.2 and iPadOS 15.7.2 Security Fixes

Released on December 13, 2022, iOS 15.7.2 and iPadOS 15.7.2 are designed to enhance the security of a range of Apple devices, from iPhone 6s to the latest iPod touch 7th generation. These updates include fixes for vulnerabilities that could potentially allow malicious actors to execute code, gain unauthorized access, or cause unexpected system behavior. Let’s delve into the specifics of each security update:

AppleAVD Vulnerability

• Affected Devices: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, iPod touch (7th generation)
• Impact: Kernel Code Execution via Malicious Video File
• Description: A critical vulnerability within AppleAVD, Apple’s audio and video decoding framework, was identified. This out-of-bounds write issue could be triggered by parsing a maliciously crafted video file. Successful exploitation could lead to kernel code execution, meaning attackers could potentially run arbitrary code with the highest system privileges, gaining significant control over your device. The vulnerability was addressed through improved input validation, ensuring that video files are properly checked before processing to prevent memory corruption.
• CVE-2022-46694: Andrey Labunets and Nikita Tarakanov are credited with reporting this vulnerability.

AVEVideoEncoder Security Issue

• Affected Devices: Same as AppleAVD
• Impact: Arbitrary Code Execution with Kernel Privileges
• Description: The AVEVideoEncoder, responsible for video encoding on Apple devices, was found to have a logic issue. This flaw could allow an application to execute arbitrary code with kernel privileges. In simpler terms, a malicious app could potentially bypass security restrictions and gain deep access to your device’s core functionalities. The update implements improved checks to address this logic issue, preventing unauthorized code execution.
• CVE-2022-42848: ABC Research s.r.o is acknowledged for discovering and reporting this vulnerability.

File System Sandbox Escape

• Affected Devices: Same as AppleAVD
• Impact: Sandbox Breakout
• Description: A vulnerability in the File System component could allow an application to break out of its sandbox. Apple’s sandbox mechanism is designed to isolate apps, limiting their access to system resources and user data, thus preventing malicious apps from harming the system or other apps. This vulnerability could allow an app to bypass these restrictions and potentially access data outside its intended boundaries. Improved checks have been implemented to reinforce the sandbox and prevent unauthorized access.
• CVE-2022-42861: pattern-f (@pattern_F_) of Ant Security Light-Year Lab is credited for reporting this sandbox escape vulnerability.

Graphics Driver System Termination

• Affected Devices: Same as AppleAVD
• Impact: Unexpected System Termination via Malicious Video File
• Description: The Graphics Driver, responsible for rendering graphics on your device, had an issue related to memory handling. Parsing a maliciously crafted video file could lead to unexpected system termination. This means a specially crafted video could crash your device. The update addresses this by improving memory handling within the Graphics Driver, preventing crashes caused by malicious video files.
• CVE-2022-42846: Willy R. Vasquez of The University of Texas at Austin is acknowledged for reporting this issue.

IOHIDFamily Race Condition

• Affected Devices: Same as AppleAVD
• Impact: Arbitrary Code Execution with Kernel Privileges
• Description: IOHIDFamily, which handles input from human interface devices (like touchscreens and keyboards), contained a race condition. Race conditions occur when the outcome of a program depends on unpredictable timing of events, which can lead to unexpected behavior and security vulnerabilities. In this case, the race condition could be exploited by an app to execute arbitrary code with kernel privileges. Improved state handling was implemented to address this race condition, ensuring more predictable and secure input processing.
• CVE-2022-42864: Tommy Muir (@Muirey03) is credited with discovering and reporting this race condition.

iTunes Store URL Parsing Vulnerability

• Affected Devices: Same as AppleAVD
• Impact: Unexpected App Termination or Arbitrary Code Execution via Remote Attack
• Description: The iTunes Store component had a vulnerability in how it parsed URLs. This issue could be exploited remotely to cause unexpected app termination or even arbitrary code execution. By crafting a malicious URL, an attacker could potentially trigger these outcomes when the iTunes Store attempts to process it. Improved input validation was implemented to ensure URLs are parsed safely, preventing malicious exploitation.
• CVE-2022-42837: Weijia Dai (@dwj1210) of Momo Security is acknowledged for reporting this URL parsing issue.

Kernel Race Condition

• Affected Devices: Same as AppleAVD
• Impact: Arbitrary Code Execution with Kernel Privileges
• Description: The Kernel, the core of the operating system, also had a race condition. Similar to the IOHIDFamily race condition, this could allow an app to execute arbitrary code with kernel privileges. Additional validation was implemented to address this kernel-level race condition, further hardening the core of the operating system.
• CVE-2022-46689: Ian Beer of Google Project Zero is credited with finding and reporting this critical kernel vulnerability.

libxml2 Integer Overflow and Input Validation Issues

• Affected Devices: Same as AppleAVD
• Impact: Unexpected App Termination or Arbitrary Code Execution via Remote Attack
• Description: libxml2, a library used for parsing XML documents, had multiple vulnerabilities. An integer overflow and other input validation issues could allow a remote user to cause unexpected app termination or arbitrary code execution. XML parsing vulnerabilities are common attack vectors, as XML is widely used in web technologies and data exchange. Improved input validation and checks were implemented to address these vulnerabilities, ensuring safer XML processing.
• CVE-2022-40303: Maddie Stone of Google Project Zero is credited with reporting the integer overflow.
• CVE-2022-40304: Ned Williamson and Nathan Wachholz of Google Project Zero are credited with reporting the other input validation issue.

ppp Memory Handling Issue

• Affected Devices: Same as AppleAVD
• Impact: Arbitrary Code Execution with Kernel Privileges
• Description: The ppp component, related to Point-to-Point Protocol networking, had a memory handling issue. This flaw could be exploited by an app to execute arbitrary code with kernel privileges. Improved memory handling was implemented to address this issue, preventing potential memory corruption and unauthorized code execution.
• CVE-2022-42840: An anonymous researcher is credited with reporting this vulnerability.

Preferences Arbitrary Entitlements

• Affected Devices: Same as AppleAVD
• Impact: Use of Arbitrary Entitlements by an App
• Description: The Preferences component had a logic issue that could allow an app to use arbitrary entitlements. Entitlements define what an app is allowed to do within the system. This vulnerability could allow a malicious app to gain capabilities it was not intended to have, potentially escalating its privileges and access. Improved state management was implemented to address this logic issue, ensuring proper entitlement enforcement.
• CVE-2022-42855: Ivan Fratric of Google Project Zero is credited with reporting this entitlement issue.

Safari UI Spoofing Vulnerability

• Affected Devices: Same as AppleAVD
• Impact: UI Spoofing via Malicious Website
• Description: Safari, Apple’s web browser, had a spoofing issue in the handling of URLs. Visiting a website that frames malicious content could lead to UI spoofing. UI spoofing is a technique where a malicious website or app disguises itself to look like something legitimate, potentially tricking users into entering sensitive information or performing unintended actions. Improved input validation was implemented to address this URL handling issue, preventing spoofing attacks in Safari.
• CVE-2022-46695: KirtiKumar Anandrao Ramchandani is acknowledged for reporting this Safari spoofing vulnerability.

TCC Sensitive Location Information Disclosure

• Affected Devices: Same as AppleAVD
• Impact: Reading Sensitive Location Information by an App
• Description: The TCC (Transparency, Consent, and Control) framework, which manages user privacy permissions, had a logic issue. This vulnerability could allow an app to read sensitive location information without proper authorization. TCC is crucial for protecting user privacy, and this vulnerability could bypass location privacy controls. Improved restrictions were implemented to address this logic issue, reinforcing location privacy protection.
• CVE-2022-46718: Michael (Biscuit) Thomas is credited with reporting this TCC vulnerability.

Weather App Sensitive Location Information Disclosure

• Affected Devices: Same as AppleAVD
• Impact: Reading Sensitive Location Information by an App
• Description: Similar to the TCC vulnerability, the Weather app also had a logic issue that could allow an app to read sensitive location information without authorization. This indicates a broader issue related to location data handling across different components. Improved restrictions were implemented to address this, reinforcing location privacy within the Weather app and potentially system-wide.
• CVE-2022-46703: Wojciech Reguła (@_r3ggi) of SecuRing, and an anonymous researcher are credited with reporting this Weather app vulnerability.

WebKit Multiple Vulnerabilities: Code Execution, Spoofing, Memory Disclosure, and Policy Bypass

• Affected Devices: Same as AppleAVD

• Impact: Various, including Arbitrary Code Execution, Address Bar Spoofing, Process Memory Disclosure, and Same Origin Policy Bypass via Malicious Web Content

• Description: WebKit, the engine behind Safari and other web-related functionalities, had a significant number of vulnerabilities addressed in iOS 15.7.2 and iPadOS 15.7.2. These include:

  • Arbitrary Code Execution via Malicious Web Content: Multiple vulnerabilities could be exploited by processing maliciously crafted web content to achieve arbitrary code execution. This is a severe type of vulnerability as it could allow attackers to run code of their choice on a user’s device simply by visiting a malicious website. (CVE-2023-23496, CVE-2022-46691, CVE-2022-46700, CVE-2022-42856)
  • Address Bar Spoofing: A spoofing issue in URL handling could lead to address bar spoofing when visiting a malicious website. This could trick users into believing they are on a legitimate website when they are actually on a malicious one. (CVE-2022-46705)
  • Process Memory Disclosure: Processing maliciously crafted web content could result in the disclosure of process memory, potentially leaking sensitive information. (CVE-2022-42852)
  • Same Origin Policy Bypass: A logic issue could allow maliciously crafted web content to bypass the Same Origin Policy. The Same Origin Policy is a fundamental security mechanism in web browsers that restricts how documents or scripts loaded from one origin can interact with resources from a different origin. Bypassing this policy could lead to cross-site scripting attacks and data theft. (CVE-2022-46692)

  These WebKit vulnerabilities were addressed through improved checks, memory handling, input validation, and state management, highlighting Apple’s ongoing efforts to secure its web browsing engine. Notably, Apple is aware of a report that CVE-2022-42856 “may have been actively exploited against versions of iOS released before iOS 15.1,” underscoring the urgency of updating to the latest versions.

• CVE-2023-23496: ChengGang Wu, Yan Kang, YuHao Hu, Yue Sun, Jiming Wang, JiKai Ren and Hang Shu of Institute of Computing Technology, Chinese Academy of Sciences

• CVE-2022-46705: Hyeon Park (@tree_segment) of Team ApplePIE

• CVE-2022-46691: An anonymous researcher

• CVE-2022-42852: hazbinhotel working with Trend Micro Zero Day Initiative

• CVE-2022-46692: KirtiKumar Anandrao Ramchandani

• CVE-2022-46700: Samuel Groß of Google V8 Security

• CVE-2022-42856: Clément Lecigne of Google’s Threat Analysis Group

Conclusion: Update to iOS 15.7.2 and iPadOS 15.7.2 for Enhanced Security

iOS 15.7.2 and iPadOS 15.7.2 are critical security updates that patch a wide array of vulnerabilities across core system components and applications. These updates protect your devices from potential threats ranging from arbitrary code execution and kernel privilege escalation to privacy breaches and denial-of-service attacks. Given the severity of some of these vulnerabilities, including the possibility of active exploitation for certain WebKit flaws, it is strongly recommended that all users of affected devices update to iOS 15.7.2 and iPadOS 15.7.2 as soon as possible to ensure they are protected against these security risks. Keeping your devices updated is a crucial step in maintaining your digital security and privacy.