CVE-2021-30807KEV · OVERDUE

Apple Multiple Products Memory Corruption Vulnerability

High · published October 19, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 98.2th percentile for exploit probability.

1803
days past CISA
deadline
CVSS v3.1
7.8
EPSS
29%
Percentile
98.2
In the wild
Confirmed
What it is

🚨 A sneaky memory corruption issue could grant attackers kernel-level access — think of it as a VIP pass that doesn't require a ticket! 🔥 Imagine a restaurant where a waiter can access the kitchen no matter what. This vulnerability allows an application to execute arbitrary code with kernel privileges, similar to a waiter sneaking into the kitchen to change orders at will. An attacker could craft a malicious application that leverages this flaw, potentially compromising the entire system. With kernel privileges, they could change settings, install malware, or even steal sensitive information. This is absolutely devastating for any affected devices!

Put simply

Imagine a restaurant where a waiter can access the kitchen no matter what. This vulnerability allows an application to execute arbitrary code with kernel privileges, similar to a waiter sneaking into the kitchen to change orders at will. This memory corruption issue manifests through improper memory handling, enabling malicious applications to run arbitrary code with elevated privileges in the kernel. It's a significant risk for users running affected versions of Apple’s operating systems.

What to do

An attacker could craft a malicious application that leverages this flaw, potentially compromising the entire system. With kernel privileges, they could change settings, install malware, or even steal sensitive information. This is absolutely devastating for any affected devices! To protect your devices, ensure you update to macOS Big Sur 11.5.1, iOS 14.7.1, iPadOS 14.7.1, or watchOS 7.6.1 immediately. Keeping your systems up to date is crucial to mitigate this vulnerability. Regularly check for updates to stay ahead of potential threats! You've got this! Stay vigilant, update those devices, and you'll be keeping your digital fortress safe! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.28839 · 98.2th percentile
Published
2021-10-19T13:12Z
KEV added
2021-11-03 · due 2021-11-17
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by Nov 17
    kev
  • 19 OCT 13:12Z
    A memory corruption issue was addressed with improved memory handling
    cvelistv5