Very High
CVE-2021-30807
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
CVE-2021-30807
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
Add Assessment
Ratings
-
Attacker ValueVery High
-
ExploitabilityHigh
Technical Analysis
Vulnerability is a WebContent->EL1 local privilege elevation vulnerability in Apple iOS and iPadOS prior to 14.7.1 that exploits a vulnerability in the IOMobileFramebufferLegacy::get_displayed_surface()
function whereby an attacker can control a 32 bit value that is being used to index into an array in order to cause an out of bound read. This can then be used to read the port name of an IOSurface object. Once this information is obtained, the attacker can then use known read/write primitives within the IOSurface object to gain the arbitrary kernel read/write they need to elevate their privileges. More details can be found at https://saaramar.github.io/IOMobileFrameBuffer_LPE_POC/ along with a working PoC.
It should be noticed that Apple has supposedly stated this was exploited in the wild according to https://support.apple.com/en-us/HT212623 however from what I’ve heard Apple has stated jailbreak exploits were “exploited in the wild” and there are rumors that this was perhaps just used by people in private to jailbreak their phones, so I’d take Apple’s word with a slight grain of salt. That being said the impact should be considered the same regardless given the relative ease of exploitation of this vulnerability combined with the fact that a working PoC has now been published.
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild ReportRatings
-
Attacker ValueVery High
-
ExploitabilityHigh
Technical Analysis
Apple is aware of a report that this issue may have been actively exploited.
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild ReportThis is not an unauthenticated attack, and it requires local access, see https://saaramar.github.io/IOMobileFrameBuffer_LPE_POC/ and https://vuldb.com/?id.179674 for more info.
CVSS V3 Severity and Metrics
General Information
Vendors
- apple
Products
- ipad os,
- iphone os,
- macos,
- watchos
Exploited in the Wild
Would you like to delete this Exploited in the Wild Report?
Yes, delete this reportReferences
Additional Info
Technical Analysis
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below: