CVE-2021-30869: Apple iOS, iPadOS, and macOS Type Confusion Vulnerability

Description

A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 12.5.5, iOS 14.4 and iPadOS 14.4, macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, Security Update 2021-006 Catalina. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of reports that an exploit for this issue exists in the wild.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)4.1% · higher than 91% of CVEs

Exploited in the wildYes

CISA KEVListed Nov 3, 2021

Federal remediation dueNov 17, 2021

Ransomware campaign useNot known

Affected products

Which versions

MA

macOS · Apple

before 11.2; before 12.5; before 2021 · source: vendor, NVD

IO

iOS · Apple

before 14.4 · source: NVD

IA

iOS and iPadOS · Apple

before 14.4 · source: vendor

MO

Mac OS X · Apple

10.14 through 10.14.6; 10.15 through 10.15.6; 10.14.6; 10.14.6; 10.14.6; 10.14.6; +19 more · source: NVD

II

iOS, iPadOS, and macOS · Apple

All versions, or not specified · source: KEV