CVE-2021-1782: Apple Multiple Products Race Condition Vulnerability

Description

A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited..

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

High

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.2% · higher than 83% of CVEs

Exploited in the wildYes

CISA KEVListed Nov 3, 2021

Federal remediation dueNov 17, 2021

Ransomware campaign useNot known

Affected products

Which versions

MA

macOS · Apple

before 11.2; before 7.3; before 14.4 · source: vendor, NVD

IO

iOS · Apple

before 14.4 · source: NVD

IA

iOS and iPadOS · Apple

before 14.4 · source: vendor

MO

Mac OS X · Apple

10.14 before 10.14.6; 10.15 before 10.15.7; 10.14.6; 10.14.6; 10.14.6; 10.14.6; +12 more · source: NVD

TV

Tvos · Apple

before 14.4 · source: NVD

WA

Watchos · Apple

before 7.3 · source: NVD

MP

Multiple Products · Apple

All versions, or not specified · source: KEV