Deserialization of Untrusted Data in macOS - CVE-2021-31010
Published: February 13, 2023
Vulnerability identifier: #VU72152
CSH Severity: High
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-31010
CWE-ID: CWE-502
Exploitation vector: Local access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a local application to escalate privileges on the system.
The vulnerability exists due to insecure input validation when processing serialized data within the Core Telephony service. A local application can pass specially crafted data to the service and execute arbitrary code on the target system.
Note, the vulnerability is being actively exploited in the wild.
Affected software
macOS
How to mitigate CVE-2021-31010
Install updates from vendor's website.
macOS - update to 11.6 20G165