Attacker Value
Very High
(2 users assessed)
Exploitability
High
(2 users assessed)
User Interaction
Unknown
Privileges Required
Unknown
Attack Vector
Unknown
2

CVE-2021-30807

Last updated April 13, 2021
Exploited in the Wild
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Privilege Escalation
Techniques
Validation
Validated

Description

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Add Assessment

3
Ratings
Technical Analysis

Vulnerability is a WebContent->EL1 local privilege elevation vulnerability in Apple iOS and iPadOS prior to 14.7.1 that exploits a vulnerability in the IOMobileFramebufferLegacy::get_displayed_surface() function whereby an attacker can control a 32 bit value that is being used to index into an array in order to cause an out of bound read. This can then be used to read the port name of an IOSurface object. Once this information is obtained, the attacker can then use known read/write primitives within the IOSurface object to gain the arbitrary kernel read/write they need to elevate their privileges. More details can be found at https://saaramar.github.io/IOMobileFrameBuffer_LPE_POC/ along with a working PoC.

It should be noticed that Apple has supposedly stated this was exploited in the wild according to https://support.apple.com/en-us/HT212623 however from what I’ve heard Apple has stated jailbreak exploits were “exploited in the wild” and there are rumors that this was perhaps just used by people in private to jailbreak their phones, so I’d take Apple’s word with a slight grain of salt. That being said the impact should be considered the same regardless given the relative ease of exploitation of this vulnerability combined with the fact that a working PoC has now been published.

General Information

Exploited in the Wild

Reported by:

Additional Info

Technical Analysis