Security experts disclose iOS / macOS vulnerability: access to Apple users' location data, photos, phone records and other information

CTOnews.com, February 22, Trellix Advanced Research Center today released a blog post revealing a privilege execution vulnerability in iOS and macOS systems that allows attackers to obtain messages, location data, photos, phone records, and so on, of iPhone and Mac users.

Trellix discovered the first vulnerability in the coreduetd process that allows attackers to access personal calendars, address books, and photos.

In addition, attackers can also take advantage of vulnerabilities in OSLogService and NSPredicate in Springboard to gain access to cameras, microphones, phone records, and so on.

Trellix has reported to Apple after discovering the vulnerability. Apple has fixed two vulnerabilities, CVE-2023-23530 and CVE-2023-23531, in iOS 16.3 and macOS 13.2Ventura.

Trellix recognized Apple's repair speed in his blog post, and subsequent tests have found that Apple has indeed fixed the above vulnerabilities by improving its memory processing mechanism.

The blog post of the official attached to CTOnews.com is as follows: Trellix Advanced Research Center Discovers a New Privilege Escalation Bug Class on macOS and iOS