Apple fixes iOS zero-day exploited in the wild (CVE-2021-30883)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-30883 | Kernel Memory Corruption Zero-Day in Apple iOS, iPadOS, macOS, tvOS, watchOS CVE-2021-30883 is a memory corruption flaw (CWE-787, out-of-bounds write) in the kernel of Apple's iOS, iPadOS, macOS, tvOS, and watchOS, addressed with improved memory handling. It is triggered by a local application that mishandles memory, with the CVSS vector (AV:L, UI:R) indicating a user must run or interact with the malicious app. Successful exploitation allows arbitrary code execution with kernel privileges, giving an attacker full control over the affected device. All users of iPhones, iPads, Macs, Apple TVs, and Apple Watches running versions earlier than the patched releases are affected. Apple acknowledged the issue may have been actively exploited in the wild, and CISA added it to the KEV catalog; related reporting indicates it was among 2021 zero-days developed commercially and sold to government clients. Do: Upgrade iPhones and iPads to iOS/iPadOS 15.0.2 (or 14.8.1 for devices staying on iOS 14), Macs to macOS Monterey 12.0.1 or Big Sur 11.6.1, Apple TVs to tvOS 15.1, and Apple Watches to watchOS 8.1. As a CISA KEV entry, the required action is to apply updates per vendor instructions; inventory managed Apple devices and verify OS versions to confirm patching, prioritizing high-risk users who may have been targeted by commercial spyware. | 7.8 | 15% | KEV |
| mass≈1 billion+ Apple devices (iPhone/iPad/Mac/Apple TV/Apple Watch installed base running the affected OS versions) |
Full article319 words · extracted from helpnetsecurity.com · click to collapse
With the newest iOS and iPad updates, Apple has fixed another vulnerability (CVE-2021-30883) that is being actively exploited by attackers.
About CVE-2021-30883
CVE-2021-30883 is a memory corruption issue in IOMobileFrameBuffer, a kernel extension for managing the screen framebuffer.
The vulnerability may be exploited by an application to execute arbitrary code with kernel privileges, Apple explained.
As per usual, Apple did not share more details about the flaw or the attack(s) exploiting it, and the researcher who discovered it remains unnamed.
But, thanks to security researcher Saar Amar, who analyzed Apple’s patch, we know that the flaw is “a classic integer overflow.”
The IOMobileFrameBuffer/AppleCLCD is, he says, a highly interesting attack surface “because it’s accessible from the app sandbox (so it’s great for jailbreaks) and many other processes, making it a good candidate for LPEs exploits in chains (WebContent, etc.).”
His write-up will be interesting for other researchers, as it details his thought process as he went through the analysis and worked on a stable POC for triggering a crash that will provide “a good panic“.
He confirmed that the POC works on iOS 15.0 and iOS 14.7.1 and says it will probably work on earlier versions of the OS.
“Unlike the previous in-the-wild vulnerability in IOMFB/AppleCLCD, no special entitlements are required. You can just create an iOS app with my POC, run it on the device and trigger the bug,” he added.
He did not release a full exploit.
Update your iDevice
The released iOS and iPadOS updates (both v15.0.2) that fix CVE-2021-30883 are available from iPhone 6s and later, all models of iPad Pro, iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and the 7th generation of iPod touch.
We don’t know the nature of the attacks exploiting the vulnerability, but users are advised to update their mobile iDevices to plug the hole as soon as possible.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/10/12/cve-2021-30883/