Trellix Advanced Research Center today released a blog post disclosing a privilege enforcement vulnerability in iOS and macOS systems that could be used by attackers to obtain messages, location data, photos, call logs and more for iPhone and Mac users.
Trellix has discovered the first vulnerability in the coreduetd process, which could be exploited by an attacker to access a person’s calendar, address book, and photos.
In addition, an attacker could also exploit vulnerabilities in OSLogService and NSPredicate in Springboard to gain access to cameras, microphones, call logs, and more.
Trellix reported the vulnerability to Apple after it was discovered. Apple has fixed both CVE-2023-23530 and CVE-2023-23531 in iOS 16.3 and macOS 13.2 Ventura.
Trellix acknowledged Apple’s speed of fix in a blog post, and subsequent testing found that Apple has indeed fixed these vulnerabilities through improved memory handling mechanisms.
