Apple Vision Pro at risk! Govt. issues high-severity alert against vulnerabilities: How to protect your device

The Indian Computer Emergency Response Team (CERT-In) has released a high-severity alert concerning multiple vulnerabilities found in Apple Vision Pro. This device operates on the newly developed VisionOS and is susceptible to severe security breaches that could allow malicious actors to seize control of the system, access confidential user information, and cause significant disruptions.

This advisory highlights that these vulnerabilities could be exploited in numerous ways, presenting substantial security risks. One of the critical flaws allows attackers to execute arbitrary code with kernel-level privileges. This capability would grant attackers the highest level of access to the system, bypassing most built-in security mechanisms, thereby enabling them to install malicious software or alter system settings without detection.

Another significant concern is the instability it introduces to applications, which may close unexpectedly. This disruption can affect the user experience and potentially result in data loss. Furthermore, the vulnerabilities allow bypassing kernel memory protections, a critical issue as this memory is vital for maintaining system stability and security.

Attackers exploiting this flaw could gain deeper access to the system, enabling them to conduct malicious activities undetected.

The advisory also warns about the potential for user fingerprinting, which involves tracking and identifying users based on their device usage. This represents a significant privacy threat as it could lead to unauthorized user profiling and monitoring. Furthermore, the vulnerabilities allow attackers to circumvent security restrictions, essentially nullifying the safeguards designed to protect the system from unauthorized access.

Another critical risk posed by these vulnerabilities is the potential for Denial of Service (DoS) attacks, which could render the device inoperable by overwhelming it with excessive requests or exploiting specific weaknesses to cause crashes. Attackers could also gain access to sensitive data stored on the device, including personal information, photos, and messages, severely compromising user privacy. Elevated privileges acquired through these vulnerabilities would enable attackers to perform actions typically restricted to system administrators, further jeopardizing the device’s security.

As per the government body, the root causes of these vulnerabilities stem from various technical issues within VisionOS components. These include ‘use-after-free’ bugs in the kernel, defects in the CoreMedia and libiconv components, out-of-bounds write and access problems, integer overflows, and type confusion errors in the WebKit component. These technical flaws can be exploited via maliciously crafted web content, resulting in memory corruption and system compromise.

Given these significant security concerns, the California-based tech giant has issued a software update for the Vision Pro. CERT-In strongly advises all users to quickly download and install this update to protect their devices from potential exploits. Maintaining up-to-date software is crucial for defending against these vulnerabilities and ensuring the system’s security and integrity.