CVE-2020-27932KEV · OVERDUE

Apple Multiple Products Type Confusion Vulnerability

High · published December 8, 2020

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 95.7th percentile for exploit probability.

1635
days past CISA
deadline
CVSS v3.1
7.8
EPSS
10%
Percentile
95.7
In the wild
Confirmed
What it is

⚡ A crafty app can exploit a type confusion issue, potentially allowing it to execute arbitrary code with kernel privileges! 🔥 Think of it like a restaurant where a waiter mistakenly serves a dish meant for a VIP table to someone who shouldn't have access — suddenly, that meal could wreak havoc! 🍽️ If an attacker successfully exploits this vulnerability, they could gain full control over the kernel, accessing sensitive data or manipulating system processes. This could lead to an absolute disaster, allowing malicious software to run amok on your device!

Put simply

Think of it like a restaurant where a waiter mistakenly serves a dish meant for a VIP table to someone who shouldn't have access — suddenly, that meal could wreak havoc! 🍽️ This vulnerability arises from improper state handling, allowing a malicious application to trick the system into executing unintended code at a high privilege level.

What to do

If an attacker successfully exploits this vulnerability, they could gain full control over the kernel, accessing sensitive data or manipulating system processes. This could lead to an absolute disaster, allowing malicious software to run amok on your device! Update your macOS to Big Sur 11.0.1 or 10.15.7 Supplemental Update, iOS to version 14.2, and ensure all devices like Apple Watches are running the latest versions mentioned in the security updates. Regularly check for and apply security patches! 🛡️ You've got this! Stay proactive, and your devices will be safer in no time! 🚀

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.10337 · 95.7th percentile
Published
2020-12-08T20:13Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 08 DEC 20:13Z
    A type confusion issue was addressed with improved state handling
    cvelistv5