Apple iOS Zero-Day Vulnerabilities Exploited in the Wild

Summary

Apple has patched three actively exploited iOS zero-day vulnerabilities. CVE-2020-27930 is a remote code execution flaw triggered by a memory corruption issue. CVE-2020-27950 is a memory initialization flaw, which causes a kernel memory leak that may allow malicious applications to gain access to kernel memory. CVE-2020-27932 is a kernel privilege escalation flaw, a type confusion issue that allows malicious applications to run arbitrary code with kernel privileges. Affected devices include iPhone 6s and later, iPod touch 7^th generation, iPad Air 2 and later, and iPad mini 4 and later. Google’s Project Zero researchers who identified the flaws indicated that these vulnerabilities were used in targeted attacks.

Recommendations

The NJCCIC recommends users of affected iOS devices to update to iOS and iPadOS 14.2 immediately. Further details can be found in the Bleeping Computer article.