Security researchers have discovered a new class of bugs that could have allowed bypassing the code signing mechanisms that protect Apple iOS and macOS from malicious code execution.
The severity of the flaws ranges between medium and high and could lead to privilege escalation or sandbox escape on either of Apple’s platforms.
Trellix notified Apple of the vulnerabilities before their disclosure, and the tech giant fixed them with the release of macOS 13.2 and iOS 16.3, currently the latest available versions.
Apple has been following a rather aggressive protection system for iOS that only permits applications signed by a verified developer certificate to run.
Moreover, the ability to dynamically execute code has been almost completely stripped, so running malicious code on iOS is virtually impossible.
Aspects of this security system have been passed to macOS, which has started to enforce similar code-signing restrictions with more vigor in recent years.
“Go Around” bugs
Trellix’s analysts discovered the possibility of running unsigned code on macOS and iOS after exploring the potential to bypass NSPredicate and NSPredicateVisitor mitigations.
The two were vulnerable classes that NSO’s Pegasus malware abused in attacks against iPhone devices involving the FORCEDENTRY zero-click remote code execution exploit.
For example, NSPredicate is a class that allows developers to filter lists of objects, but attackers found a way to abuse it to dynamically execute arbitrary code in another process.
Abusing NSPredicate for unsigned code execution was reported to Apple back in 2019 and then extensively detailed in a