CVE-2022-26710 - Exploiting the Use-After-Free in Apple WebKit

Apple’s platforms are widely considered secure, but every so often, a critical vulnerability slips through. CVE-2022-26710 is one such case—a use-after-free bug in WebKit that, if exploited, could allow attackers to execute code just by getting you to load a booby-trapped website. In this post, I’ll break down what this bug is, how it was exploited, demonstrate attack code, and show how Apple finally squashed it.

What is CVE-2022-26710?

CVE-2022-26710 is a security vulnerability in WebKit, the web engine behind Safari and many other apps on Mac, iPhone, iPad, Apple Watch, and Apple TV.

Fixed in: iOS 15.5, iPadOS 15.5, macOS Monterey 12.4, tvOS 15.5, watchOS 8.6

In simple terms, a “use-after-free” bug happens when the code uses a part of memory after it has already been released. Attackers can exploit this to run their own code, especially in browsers.

Official Links

- Apple Security Updates
- CVE MITRE Details
- WebKit Bug #238703

Exploit Details — How Does the Bug Work?

Imagine the browser loads a special web page designed by an attacker. The page manipulates how WebKit handles internal objects, tricking it into freeing an object and then still using it (now with possible attacker-provided data in that memory spot). This lets the attacker control what gets executed.

Code Execution:

When the browser tries to use the “zombie” object, it actually uses the attacker’s data, which can lead to code execution.

Below is a pseudo-proof-of-concept in JavaScript, similar to how researchers may demonstrate these

// Hypothetical PoC for educational use
let a = document.createElement("div");
document.body.appendChild(a);

// Step 1: Remove and free 'a'
document.body.removeChild(a);

// Step 2: Force GC to free memory (not guaranteed)
for (let i=; i<10000; i++) { new Array(100); }

// Step 3: Allocate a new object in the same memory
// Sometimes JS arrays or buffers re-use freed space
let spray = [];
for (let i=; i<100000; i++) {
  spray.push(new Uint32Array(100));
}

// Step 4: Trigger use-after-free (hypothetical vulnerable function)
// e.g., WebKit mistakenly accesses 'a' after it has been freed

// Real-world details are more complex and browser-version dependent

> Disclaimer: The above code is for educational purposes and won’t work against a patched browser. Real attack code would use more advanced heap grooming and timing tricks.

The Impact

- Remote code execution: Just visiting a malicious web page could let an attacker install spyware or malware.

No user interaction required: The user doesn't have to do anything but load a page.

- Affects many platforms: iPhone, iPad, Mac, Apple TV, Apple Watch. Almost any device using WebKit.

Why So Serious?

WebKit is everywhere on Apple platforms—even third-party browsers on iOS must use it—so this bug’s reach was huge.

How Did Apple Fix It?

Apple credits an unnamed researcher for reporting the issue. The fix was simple in principle: the engineers added better memory management, making sure no code path could use an object after it was freed.

From Apple’s Release Notes

> "A use after free issue was addressed with improved memory management. Processing maliciously crafted web content may lead to arbitrary code execution."

After macOS Monterey 12.4, iOS 15.5, iPadOS 15.5, watchOS 8.6, and tvOS 15.5, the vulnerable code is no longer reachable by attackers.

Ready to Stay Safe?

- Update Now! If you’re on any version older than iOS 15.5, macOS 12.4, or the tvOS/watchOS equivalents, update as soon as possible.

Don’t disable system updates. These bugs can be weaponized rapidly.

- Be careful what links and emails you open – though after this patch, at least this attack vector is blocked.

Timeline

Published on: 11/01/2022 20:15:00 UTC
Last modified on: 11/03/2022 13:48:00 UTC

CVE-2022-26710 - Exploiting the Use-After-Free in Apple WebKit – A Deep Dive