Apple patches iOS against 3 actively exploited 0-days found by Google

Apple has patched iOS against three zero-day vulnerabilities that attackers were actively exploiting in the wild. The attacks were discovered by Google’s Project Zero vulnerability research group, which over the past few weeks has detected four other zero-day exploits—three against Chrome and a third against Windows.

The security flaws affect iPhone 6s and later, seventh-generation iPod touches, iPad Air 2s and later, and iPad mini 4s and later. The flaws are:

• CVE-2020-27930, a code-execution vulnerability that attackers can trigger using maliciously crafted fonts
• CVE-2020-27950, which allows a malicious app to obtain the locations in kernel memory, and
• CVE-2020-27932, a bug that allows code to run with highly privileged system rights.

Apple has fixed the zero-days and other vulnerabilities with the release of iOS 14.2 earlier. Apple patched the same vulnerabilities in the Supplementary Update for macOS Catalina 10.15.7. Project Zero leader Ben Hawkes provided his own bare-bones disclosure here.

The disclosure marks the fifth, sixth, and seventh zero-days Project Zero has reported since October 20. CVE-2020-15999, CVE-2020-16009, and CVE-2020-16010 affected Chrome desktop or Chrome for Android. Meanwhile, Project Zero also discovered CVE-2020-17087, a Windows 10 and Windows 7 flaw that allows attackers to escalate system privileges. Hackers had been combining CVE-2020-15999 with CVE-2020-17087. The first one gained limited code execution, and the second ran it with elevated system privileges.

Google has provided no details about the attacks other than they’re targeted (meaning they go after specific individuals of interest) and they’re not related to the November elections. Patches are available for all vulnerabilities other than the Windows one, which is expected to be fixed on Tuesday. While few if any readers were likely targeted with the iOS exploits, people should install Thursday’s release of 14.2 as soon as is practical.