Investigating a Serious Vulnerability Fixed in iOS 16.3 and macOS 13.2

Nearly every update to iOS and macOS includes a variety of security improvements added by Apple to address important vulnerabilities. Both updates fixed a number of problems, two of which were mentioned in a Trellix report today.

Trellix Advanced Research Center discovered a brand-new category of privilege execution bugs in iOS and macOS. An iPhone or Mac user’s messages, location data, photos, call history, and other data may be accessible thanks to these bugs.

Trellix explains how mitigations that Apple implemented for the FORCEDENTRY zero-click exploit in September 2021 could be bypassed, allowing for a “huge range of potential vulnerabilities” in a blog post outlining how the bug was discovered. The credited process was the target of the first vulnerability discovered by Trellix, which could have allowed an attacker access to a victim’s address book, calendar, and photos.

After receiving information about these flaws, Apple patched the exploits in iOS 16.3 and macOS 13.2 Ventura. Trellix is responsible for two security holes (CVE-2023-23530 and CVE-2023-23531), which Apple fixed with better memory management.