{"id":43650,"date":"2022-02-11T05:30:03","date_gmt":"2022-02-11T10:30:03","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=43650"},"modified":"2022-08-10T18:54:33","modified_gmt":"2022-08-10T22:54:33","slug":"webkit-vulnerability-cve-2022-22620","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/webkit-vulnerability-cve-2022-22620\/43650\/","title":{"rendered":"Update iOS, there is a dangerous vulnerability in WebKit"},"content":{"rendered":"

Apple has released an urgent update for iOS and iPadOS that fixes the CVE-2022-22620<\/a> vulnerability. They recommend<\/a> updating devices as soon as possible, as the company have reason to believe that the vulnerability is already being actively exploited by unknown actors.<\/p>\n

Why vulnerability CVE-2022-22620 is dangerous<\/h2>\n

As usual, Apple experts do not disclose the details of the vulnerability until the investigation is completed, and the majority of users have the patches installed. At the moment, they only say that the vulnerability belongs to the Use-After-Free (UAF)<\/a> class, therefore it is related to incorrect use of dynamic memory in applications. Its exploitation allows the attacker to create malicious web content, the processing of which can lead to arbitrary code execution on the victim\u2019s device.<\/p>\n

Simply put, the most likely attack scenario is an infection of an iPhone or iPad device after visiting a malicious web page.<\/p>\n

Which devices and apps are vulnerable to CVE-2022-22620 exploitation<\/h2>\n

Judging by the description of the bug, the vulnerability was found in the WebKit engine used in many applications for macOS, iOS and Linux. In particular, all browsers for iOS and iPadOS are based on this open source engine \u2014 that is, not only iPhone\u2019s default Safari, but also Google Chrome, Mozilla Firefox and any others. So even if you do not use Safari, this vulnerability still affects you directly.<\/p>\n

Apple released updates for iPhones 6s and newer; all models of iPad Pro, iPad Air version 2 and newer, iPad starting with the 5th generation, iPad mini starting with 4th generation, and iPod touch media player starting with the 7th generation.<\/p>\n

How to stay safe <\/h2>\n

The patches that Apple released on February 10 changes memory management mechanisms and thus prevents exploitation of CVE-2022-22620. So in order to protect your device, it should be enough to install iOS 15.3.1 and iPadOS 15.3.1 updates. Your device needs to be connected to a Wi-Fi network to install the patch.<\/p>\n

If your device does not yet show a notification that the update is ready for installation, you can force your system into updating a little bit quicker: go to the system settings yourself (Settings \u2192 General \u2192 Software update) and check the availability of software updates.<\/p>\n

In order to get alerts about the latest cyberthreats directly related to your devices and apps, we recommend using the Kaspersky Security Cloud<\/a>, available for Windows, macOS, Android and iOS operating systems. When a new vulnerability in the software you use, or a data leak on the website you visit is discovered, you will get a notification with advice on how to protect yourself.<\/p>\n\n","protected":false},"excerpt":{"rendered":"

Dangerous vulnerability in WebKit (CVE-2022-22620) is believed to be actively exploited by hackers. Update your iOS devices as soon as possible!<\/p>\n","protected":false},"author":2698,"featured_media":43651,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2683],"tags":[14,1250,100,4292,26,268],"class_list":{"0":"post-43650","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"tag-apple","9":"tag-ios","10":"tag-ipad","11":"tag-ipados","12":"tag-iphone","13":"tag-vulnerabilities"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/webkit-vulnerability-cve-2022-22620\/43650\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/webkit-vulnerability-cve-2022-22620\/23891\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/webkit-vulnerability-cve-2022-22620\/19388\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/webkit-vulnerability-cve-2022-22620\/9737\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/webkit-vulnerability-cve-2022-22620\/26140\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/webkit-vulnerability-cve-2022-22620\/24101\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/webkit-vulnerability-cve-2022-22620\/23907\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/webkit-vulnerability-cve-2022-22620\/26913\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/webkit-vulnerability-cve-2022-22620\/26450\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/webkit-vulnerability-cve-2022-22620\/32366\/"},{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/webkit-vulnerability-cve-2022-22620\/10519\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/webkit-vulnerability-cve-2022-22620\/18550\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/webkit-vulnerability-cve-2022-22620\/18968\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/webkit-vulnerability-cve-2022-22620\/15799\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/webkit-vulnerability-cve-2022-22620\/28140\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/webkit-vulnerability-cve-2022-22620\/32416\/"},{"hreflang":"nl","url":"https:\/\/www.kaspersky.nl\/blog\/webkit-vulnerability-cve-2022-22620\/28109\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/webkit-vulnerability-cve-2022-22620\/24822\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/webkit-vulnerability-cve-2022-22620\/30235\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/webkit-vulnerability-cve-2022-22620\/30024\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/ios\/","name":"iOS"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/43650","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/2698"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=43650"}],"version-history":[{"count":5,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/43650\/revisions"}],"predecessor-version":[{"id":43653,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/43650\/revisions\/43653"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/43651"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=43650"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=43650"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=43650"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}