A new vulnerability, classified as CVE-2022-26716, has been identified in the Webkit engine, which is utilized by Apple's Safari and other iOS applications. This vulnerability is a memory corruption issue that may lead to arbitrary code execution when processing malicious web content. Apple has addressed this issue by improving state management, and the fix is included in the following updates:

Background

Webkit is the popular open-source web browser engine used by Apple's Safari browser, Mail app, and other third-party applications. It supports standards like HTML5, CSS, and JavaScript, and aims to prioritize performance and compatibility.

This memory corruption issue (CVE-2022-26716) was discovered by an anonymous researcher who reported it through the Apple Product Security Vulnerability Reporting process. A security advisory was also published by Apple, detailing the issue and software updates that address it.

Exploit Details

The exploit takes advantage of the vulnerable state management in Webkit, which can cause memory corruption when processing malicious web content. Attackers can craft a specially designed website or web content to trigger the vulnerability and execute arbitrary code on the user's device.

While specific exploit code has not been released, the vulnerability is presumed to be present in earlier versions of the affected software. Users are strongly encouraged to update their software to the latest versions to mitigate the risk of exploitation.

Consider the following JavaScript code snippet that may be embedded in a webpage

function maliciousFunction() {
  let corruptedMemory = new ArrayBuffer(255);
  // ... Manipulation of memory contents ...
  return corruptedMemory;
}

This malicious code could trigger memory corruption issues and potentially lead to arbitrary code execution in vulnerable Webkit implementations. Note that this is a simple example, and actual exploit code is likely to be much more complex.

Recommendations

To protect yourself against this vulnerability, it is strongly recommended that you update the following:

- tvOS 15.5 is available through Apple's tvOS updates (Settings > System > Software Updates > Update Software)

iOS 15.5 and iPadOS 15.5 can be obtained via the Settings app (Settings > General > Software Update)

- watchOS 8.6 should be applied through the Watch app on your iPhone (My Watch > General > Software Update)
- macOS Monterey 12.4 can be installed from the App Store or System Preferences panel (Apple menu > System Preferences > Software Update)

Safari 15.5 is available as an App Store update on macOS

- Apple Security Advisory - https://support.apple.com/en-us/HT213596
- Apple Vulnerability Reporting - https://support.apple.com/HT201220
- Webkit Engine - https://webkit.org/

Don't wait to update the affected software to protect yourself from CVE-2022-26716, a memory corruption issue that could lead to arbitrary code execution. Following the recommendations outlined above will help ensure the security of your devices and personal data.

Timeline

Published on: 11/01/2022 20:15:00 UTC
Last modified on: 11/03/2022 13:48:00 UTC