Attacker Value
Very High
(2 users assessed)
Exploitability
High
(2 users assessed)
User Interaction
Required
Privileges Required
None
Attack Vector
Local
2

CVE-2021-30807

Disclosure Date: October 19, 2021
Exploited in the Wild
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Privilege Escalation
Techniques
Validation
Validated

Description

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.

Add Assessment

3
Ratings
Technical Analysis

Vulnerability is a WebContent->EL1 local privilege elevation vulnerability in Apple iOS and iPadOS prior to 14.7.1 that exploits a vulnerability in the IOMobileFramebufferLegacy::get_displayed_surface() function whereby an attacker can control a 32 bit value that is being used to index into an array in order to cause an out of bound read. This can then be used to read the port name of an IOSurface object. Once this information is obtained, the attacker can then use known read/write primitives within the IOSurface object to gain the arbitrary kernel read/write they need to elevate their privileges. More details can be found at https://saaramar.github.io/IOMobileFrameBuffer_LPE_POC/ along with a working PoC.

It should be noticed that Apple has supposedly stated this was exploited in the wild according to https://support.apple.com/en-us/HT212623 however from what I’ve heard Apple has stated jailbreak exploits were “exploited in the wild” and there are rumors that this was perhaps just used by people in private to jailbreak their phones, so I’d take Apple’s word with a slight grain of salt. That being said the impact should be considered the same regardless given the relative ease of exploitation of this vulnerability combined with the fact that a working PoC has now been published.

CVSS V3 Severity and Metrics
Base Score:
7.8 High
Impact Score:
5.9
Exploitability Score:
1.8
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
Required
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • Apple

Products

  • macOS,
  • macOS,
  • macOS

Exploited in the Wild

Reported by:

Additional Info

Technical Analysis