Apple Patches Coruna Exploit With iOS 16 and iOS 15 Updates

Updates patch the Coruna exploit

Apple on Wednesday released new updates for iPhone models still running iOS 16 and iOS 15, aimed at older devices that cannot be updated to newer firmware. The Cupertino company has confirmed that the updates address vulnerabilities associated with the Coruna exploit recently disclosed by researchers. Alongside, similar updates have been released for older iPad models running iPadOS 16 and iPadOS 15. The company described the updates as containing important security fixes.

The updates cover devices ranging from iOS 13 up to iOS 17.2.1, extending protections to machines that no longer receive the latest software. Security researchers noted that Coruna combines multiple flaws to compromise affected devices, and Apple said the released patches address those vulnerabilities. The company’s security notes emphasize that the fixes patch kernel and WebKit vulnerabilities tied to Coruna.

• Supported operating systems patched: iOS 16.7.15, iOS 15.8.7, iPadOS 16.7.15, iPadOS 15.8.7
• Security emphasis: kernel and WebKit vulnerabilities addressed

A major patch targets a kernel vulnerability that could allow an app to execute arbitrary code with kernel privileges. Apple describes the issue as caused by a use-after-free bug, with improvements to memory management intended to mitigate the risk. The vulnerability is tracked as CVE-2023-41974.

In addition, several WebKit-related vulnerabilities were addressed as part of the updates. These flaws could allow maliciously crafted web content to trigger arbitrary code execution or memory corruption, according to Apple’s security notes. One WebKit bug, CVE-2024-23222, was caused by a type confusion issue and fixed through improved checks. Other WebKit vulnerabilities, CVE-2023-43000 and CVE-2023-43010, were tied to use-after-free and overall memory handling concerns.

Apple noted that, while some fixes had previously appeared in newer releases, the new updates extend protections to older devices that are no longer eligible for the latest software versions.

What is the Coruna exploit

The Coruna exploit was discovered by Google Threat Intelligence Group (GTIG) earlier this month. Researchers described it as combining five full iOS exploit chains and a total of 23 vulnerabilities to target devices running older iPhone software. According to Google’s analysis, the exploit chain could enable attackers to bypass several layers of system protection if triggered and could grant deeper access to a device and the ability to execute malicious code. The Coruna project is said to affect devices running iOS versions from iOS 13 through iOS 17.2.1, released between 2019 and 2023.

Security researchers highlight that the exploit sequence relies on chaining multiple flaws, which underscores the risk for users still on older iPhone or iPad hardware that cannot upgrade to the latest operating systems. The combination of kernel and WebKit vulnerabilities could, in theory, widen an attacker’s control on an affected device when triggered by crafted content or apps.

How to install the latest iOS 16 and iOS 15 updates

Apple recommends that users install the latest available updates on their iPhone and iPad models, particularly if they are still running older iOS or iPadOS versions. The steps below outline the official process:

1. Open the Settings app on your iPhone
2. Go to General > Software Update
3. The iPhone will check for any pending updates automatically
4. Tap on Download & Install, read and accept the terms and conditions
5. Wait for the update to install. Your iPhone may reboot several times during the update process

These updates are designed to extend protections to older devices that can no longer receive the latest firmware releases. Apple did not indicate regional availability details in the material provided, but the new builds are described as broadly applicable to older iPhone and iPad models within the supported ranges.

Context and next steps

Security researchers and Apple alike emphasize the importance of applying these updates on older devices to mitigate exposure to the Coruna exploit. While newer devices can run newer software, older iPhone and iPad owners are urged to install the patches to close the security gaps identified in Coruna-related findings. The company did not announce additional follow-up fixes beyond what is described in the current security notes, but observers will watch for any future refinements tied to this threat vector.