Affected Devices and Software Versions:

• iOS 15.8.4 and iPadOS 15.8.4: Compatible with iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch (7th generation).
• iOS 16.7.11 and iPadOS 16.7.11: Supports iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch, and iPad Pro 12.9-inch 1st generation.
• iPadOS 17.7.6: Applicable to iPad Pro 12.9-inch 2nd generation, iPad Pro 10.5-inch, and iPad 6th generation.​

Details of the Vulnerabilities:

1. CVE-2025-24085 (CVSS score: 7.3): A use-after-free flaw in the Core Media component that could allow a malicious application to escalate privileges on the device.​
2. CVE-2025-24200 (CVSS score: 4.6): An authorization issue in the Accessibility component, potentially enabling an attacker to disable USB Restricted Mode on a locked device, facilitating physical cyber attacks.​
3. CVE-2025-24201 (CVSS score: 8.8): An out-of-bounds write issue in the WebKit component, allowing crafted web content to execute code outside the Web Content sandbox.​

Impact and Exploitation:

These vulnerabilities have been confirmed to be under active exploitation, posing significant risks to affected devices. Exploitation could lead to unauthorized access, data compromise, and further malicious activities.​

Mitigation Steps:

Apple has released patches for these vulnerabilities in the following software versions:​

• CVE-2025-24085: Fixed in macOS Sonoma 14.7.5, macOS Ventura 13.7.5, and iPadOS 17.7.6.​
• CVE-2025-24200 and CVE-2025-24201: Addressed in iOS 15.8.4, iPadOS 15.8.4, iOS 16.7.11, and iPadOS 16.7.11.​

Users are strongly advised to update their devices to these latest versions to protect against potential exploits.​

Expert Opinions:

Cybersecurity experts emphasize the importance of timely updates, especially when vulnerabilities are known to be actively exploited. Regularly updating devices ensures protection against known threats and enhances overall security posture.​

Conclusion:

Apple’s proactive approach in backporting fixes to older devices underscores its commitment to user security across its product range. Users should promptly apply these updates to mitigate risks associated with these vulnerabilities.

The post Apple Releases Security Updates to Fix Three Actively Exploited Zero-Day Vulnerabilities in iOS and macOS appeared first on CyberHood Sentinel.

Understanding the Vulnerability

System Integrity Protection, or SIP, is a cornerstone of macOS security, introduced to safeguard the system against unauthorized modifications. Often referred to as “rootless,” this feature restricts even the root user—traditionally the most powerful account on a Unix-based system—from making changes to critical system files and directories. SIP plays a pivotal role in maintaining the stability and security of macOS devices, making any potential bypass a matter of serious concern.

The flaw discovered by Microsoft’s Threat Intelligence team involves the Storage Kit daemon (storagekitd) in macOS. Exploiting this vulnerability, attackers with root privileges could manipulate the “com.apple.rootless.install.heritable” entitlement, enabling them to circumvent SIP protections. The attack vector leverages storagekitd’s capability to invoke arbitrary processes, allowing the introduction of new file system bundles to critical directories such as /Library/Filesystems. By overriding binaries associated with Disk Utility, malicious actors could bypass SIP entirely.

Jonathan Bar Or, a leading researcher from Microsoft’s team, emphasized the potential impact of such an exploit. “A successful attack could lead to the installation of rootkits, creation of persistent malware, and expansion of the attack surface for further exploits. It underscores the need for vigilant security practices,” he noted in a detailed blog post.

Previous SIP Bypass Vulnerabilities

This discovery marks the third major SIP bypass vulnerability reported by Microsoft in recent years. Previously identified flaws, such as CVE-2021-30892 (dubbed “Shrootless”) and CVE-2023-32369 (known as “Migraine”), similarly showcased the potential for attackers to exploit macOS’s protective mechanisms. Together, these vulnerabilities underscore a pattern of exploitation attempts targeting the SIP framework.

Potential Impacts of Exploiting CVE-2024-44243

The implications of this vulnerability are severe, particularly given the critical role SIP plays in macOS’s defense against malware and other threats. By bypassing SIP, attackers could:

1. Install Rootkits: With unrestricted access, attackers can introduce rootkits—malicious software designed to remain undetected while providing privileged access to the system.
2. Persistent Malware Installation: Exploiting this flaw could allow attackers to install malware that remains active even after system reboots or security updates.
3. Expand Attack Surfaces: SIP bypass opens the door for additional exploits, enabling attackers to escalate privileges further or gain access to sensitive user data.
4. Erode Trust in macOS Security: Beyond technical risks, such vulnerabilities could undermine user confidence in macOS as a secure platform.

Apple’s Response and Mitigation

Apple responded swiftly to Microsoft’s disclosure by releasing a patch in the macOS Sequoia 15.2 update. Users are strongly encouraged to update their devices immediately to mitigate potential risks. Regular system updates are a fundamental aspect of maintaining a secure computing environment, particularly as threat actors continuously evolve their techniques.

To ensure your macOS device is protected, follow these steps:

1. Check for Updates: Navigate to System Settings > Software Update and install the latest macOS version.
2. Enable Automatic Updates: Configure your system to automatically download and install security updates.
3. Review Security Settings: Ensure SIP is enabled. You can verify its status by running the csrutil status command in the Terminal.
4. Monitor for Anomalies: Regularly check for unexpected system behavior or unauthorized changes to critical files and directories.

The Role of Collaborative Security Research

The discovery of CVE-2024-44243 highlights the importance of collaborative efforts between technology companies to identify and mitigate vulnerabilities. Microsoft’s role in uncovering this flaw demonstrates the value of cross-platform security research and shared responsibility in safeguarding users.

“Security is a shared endeavor,” said Bar Or. “Our partnership with Apple reflects a commitment to protecting users and staying ahead of evolving threats. Transparency and collaboration are key to building resilient systems.”

The Broader Context: Security Challenges for macOS

While macOS is often perceived as a more secure platform compared to its counterparts, it is not immune to vulnerabilities. The increasing popularity of macOS devices has made them an attractive target for cybercriminals. Exploits like CVE-2024-44243 serve as a reminder that no system is invulnerable.

Recent years have seen a rise in macOS-specific threats, from adware and ransomware to sophisticated spyware targeting high-value users. Attackers are leveraging both social engineering tactics and technical vulnerabilities to bypass security measures. For macOS users, maintaining robust cybersecurity practices is more critical than ever.

Best Practices for macOS Security

To enhance your macOS security posture, consider the following recommendations:

1. Stay Updated: Install updates promptly to address newly discovered vulnerabilities.
2. Use Strong Passwords: Implement strong, unique passwords for system accounts.
3. Enable Two-Factor Authentication (2FA): Protect your Apple ID and other accounts with 2FA.
4. Limit Admin Privileges: Use a standard user account for daily activities and reserve administrative access for specific tasks.
5. Install Security Software: Utilize trusted antivirus and anti-malware tools to detect and prevent threats.
6. Exercise Caution with Downloads: Avoid downloading software from untrusted sources and verify app permissions.
7. Regularly Back Up Data: Maintain backups of your critical files using Time Machine or other reliable backup solutions.

Conclusion

The disclosure of CVE-2024-44243 serves as a stark reminder of the dynamic nature of cybersecurity threats. While Apple’s swift response in patching the vulnerability is commendable, users must remain vigilant and proactive in maintaining their security. Collaborative efforts between technology companies, combined with user awareness, are essential in mitigating risks and ensuring a safer digital ecosystem.

As macOS continues to gain popularity, it will undoubtedly remain a focal point for attackers. By staying informed and adopting best practices, users can play an active role in defending against emerging threats. Ultimately, security is not just a feature but a shared responsibility that requires constant vigilance and adaptability.

The post Microsoft Uncovers New macOS Vulnerability Allowing System Integrity Protection Bypass appeared first on CyberHood Sentinel.