CVE-2020-27950

CVE-2020-27950 is an improper memory initialization flaw (CWE-665) in the kernels of Apple's iOS, iPadOS, macOS, and watchOS, addressed in the November 2020 update round. It is triggered when a user runs a malicious application on a vulnerable device; because kernel memory is not properly initialized, the app can read leftover kernel data. A successful attacker gains disclosure of sensitive kernel memory, which can expose secrets or weaken kernel defenses, though the local, user-interaction-dependent attack path keeps the CVSS 3.1 score at a moderate 5.5. Affected populations include iPhone and iPad users on builds older than iOS/iPadOS 14.2 (or iOS 12.4.9 on legacy devices), Mac users on High Sierra, Mojave, Catalina, and early Big Sur, and Apple Watch users on older watchOS branches. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), and related reporting ties the timeframe to the 'Coruna' iOS exploit kit attributed to an advanced, previously unidentified hacking group, indicating exploitation in the wild.

What to do: Update iPhones and iPads to iOS/iPadOS 14.2 (or iOS 12.4.9 for devices that cannot run newer branches), Macs to macOS Big Sur 11.0.1, the macOS Catalina 10.15.7 Supplemental Update, or Security Update 2020-006 for High Sierra/Mojave, and Apple Watches to watchOS 7.1, 6.2.9, or 5.3.9 per device generation. As a CISA KEV entry, federal and high-value environments should prioritize this patch and check for signs of malicious local applications on unpatched devices. There is no practical workaround because the flaw is in the kernel.