Type Confusion in macOS - CVE-2021-30869
Published: September 23, 2021 / Updated: September 24, 2021
Vulnerability identifier: #VU56845
CSH Severity: High
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-30869
CWE-ID: CWE-843
Exploitation vector: Local access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a type confusion error within the XNU subsystem. A local user can run a specially crafted program to trigger a type confusion error and execute arbitrary code with elevated privileges.
Note, the vulnerability is being actively exploited in the wild.
Affected software
macOS
Apple iOS
iPadOS
Apple iOS
iPadOS
How to mitigate CVE-2021-30869
Install updates from vendor's website.
macOS - update to 10.15.7 19H1419
Apple iOS - addressed in versions 12.5.5 16H62, 14.4 18D52
iPadOS - update to 14.4 18D52
Apple iOS - addressed in versions 12.5.5 16H62, 14.4 18D52
iPadOS - update to 14.4 18D52