Actively exploited · Published Dec 8, 2020 · Assigned by apple
CVE-2020-27950
Medium 5.5 Exploited
In plain English
A medium-severity security flaw in iOS and iPadOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 16.5% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. A malicious application may be able to disclose kernel memory.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apple | watchOS | unspecified – before 7.1 |
| Apple | iOS and iPadOS | unspecified – before 14.2 |
| Apple | macOS | unspecified – before 11.0 |
| Apple | macOS | unspecified – before 12.4 |
| Apple | macOS | unspecified – before 6.2 |
| Apple | macOS | unspecified – before 5.3 |
| Apple | macOS | unspecified – before 2020 |
| Apple | macOS | unspecified – before 10.15 |
Weakness: CWE-665 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- https://support.apple.com/en-us/HT211931 x_refsource_MISC
- https://support.apple.com/en-us/HT211928 x_refsource_MISC
- https://support.apple.com/en-us/HT211929 x_refsource_MISC
- https://support.apple.com/en-us/HT211940 x_refsource_MISC
- https://support.apple.com/en-us/HT211944 x_refsource_MISC
- https://support.apple.com/en-us/HT211945 x_refsource_MISC
- https://support.apple.com/en-us/HT211946 x_refsource_MISC
- https://support.apple.com/en-us/HT211947 x_refsource_MISC
- 20201215 APPLE-SA-2020-12-14-4 Additional information for APPLE-SA-2020-11-13-1 macOS Big Sur 11.0.1 mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/161296/XNU-Kernel-Mach-Message-Trailers-Memory-Disclosure.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-27950 government-resource