Apple has released a supplemental update to macOS Catalina 10.15.5 that addresses an arbitrary code execution bug stemming from a memory consumption flaw.
This fine-tuning appears to only cover a single security weakness, with no feature tweaks or suchlike prominent modifications being under its hood. According to the release notes, the improvement addresses a vulnerability documented as CVE-2020-9859. On a side note, this is an imperfection affecting unpatched versions of macOS, iOS, and iPadOS that enabled the so-called unc0ver jailbreak. Although the hack applied to iOS/iPadOS 11 and newer, including the latest version 13.5, the patch is apparently aimed at fixing the flaw across both the mobile and computer platforms. A quick look at the security implication of this update reveals that it takes care of a “memory consumption issue” by introducing improvements to the memory handling process.
By piggybacking on the now-fixed vulnerability, an attacker could execute a dodgy application with kernel permissions. To get a better idea of how this worked, let’s zoom into the above-mentioned jailbreak tool. It was masterminded by a crew of white hat hackers and cybersecurity enthusiasts calling themselves unc0ver. The logic of the exploitation was to leverage an uncatalogued weakness in the XNU kernel that controls a device’s hardware. As a result of the compromise, one could get superuser privileges and install applications from outside of the officially approved sources. The benefits of using the tool included battery life intactness, a fully-fledged set of native iOS features still in place, unaffected level of built-in security, as well as an ability to withstand operating system updates and to stay in effect after reboots.
Whereas the loophole has only been harnessed within the iOS ecosystem – and not quite maliciously – it was also present in macOS High Sierra 10.13.6 and macOS Catalina 10.15.5. The latter build, the fifth update to Catalina since its original release back in October 2019, went live just last week. It introduced, among other things, the all-new Battery Health Management feature supported by Mac machines that have Thunderbolt 3 ports. This unique functionality lowers the rate of a battery’s chemical aging by adjusting its charging thresholds based on a Mac owner’s usage patterns.
Obviously, the company’s security engineers had to plunge headlong into extra fixes after the newsmaking announcement of the unc0ver jailbreak in late May 2020. With that said, Apple has been super-busy tailoring updates to all of its operating systems lately. In addition to the macOS Catalina 10.15.5 interim release, the following version updates are now underway: iOS/iPadOS 13.5.1, watchOS 6.2.6, and tvOS 13.4.6. These ones also took root about a week after the previous updates kicked off. While it’s clear that iOS and iPadOS 13.5.1 tackle the bug that fuels the jailbreak described above, Apple hasn’t specified what kind of security fixes the versions of the other two platforms come with.
