Use-after-free in watchOS - CVE-2020-9768

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error. A remote attacker can use a specially crafted application and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Affected software

How to mitigate CVE-2020-9768

Links to Public Exploits and PoC-codes

• Exploit #5138 - CVE-2020-9768 (AppleJPEGDriverUserClient : mach port use-after-free/type-confusion via race condition) (February 11, 2021)
• Exploit #2892 - CVE-2020-9768 (AppleJPEGDriverUserClient : mach port use-after-free/type-confusion via race condition) (June 3, 2020)

External References

• https://seclists.org/fulldisclosure/2020/Mar/33
• https://support.apple.com/en-il/HT211103

Related Security Bulletins

• Multiple vulnerabilities in Apple watchOS
• Multiple vulnerabilities in Apple iOS and iPadOS