Actively exploited · Published Aug 24, 2021 · Assigned by apple
CVE-2021-30858
High 8.8 Exploited
In plain English
A high-severity use-after-free in iOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 13.4% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Nov 17, 2021.
Official description
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | webkit2gtk | 2.32.4-r0 | ALPINE-CVE-2021-30858 |
| Debian:12 | webkit2gtk | 2.32.4-1 | DEBIAN-CVE-2021-30858 |
| Debian:13 | webkit2gtk | 2.32.4-1 | DEBIAN-CVE-2021-30858 |
| Debian:14 | webkit2gtk | 2.32.4-1 | DEBIAN-CVE-2021-30858 |
| Debian:12 | wpewebkit | 2.32.4-1 | DEBIAN-CVE-2021-30858 |
| Debian:13 | wpewebkit | 2.32.4-1 | DEBIAN-CVE-2021-30858 |
| Debian:14 | wpewebkit | 2.32.4-1 | DEBIAN-CVE-2021-30858 |
| Rocky Linux:8 | webkit2gtk3 | 0:2.30.4-3.el8_4 | RLSA-2021:4097 |
| Ubuntu:22.04:LTS | qtwebkit-opensource-src | no fix listed | UBUNTU-CVE-2021-30858 |
| Ubuntu:24.04:LTS | qtwebkit-opensource-src | no fix listed | UBUNTU-CVE-2021-30858 |
| Ubuntu:22.04:LTS | wpewebkit | no fix listed | UBUNTU-CVE-2021-30858 |
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT212804 x_refsource_MISC
- https://support.apple.com/en-us/HT212807 x_refsource_MISC
- 20210917 APPLE-SA-2021-09-13-3 macOS Big Sur 11.6 mailing-list, x_refsource_FULLDISC
- 20210917 APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8 mailing-list, x_refsource_FULLDISC
- 20210917 APPLE-SA-2021-09-13-5 Safari 14.1.2 mailing-list, x_refsource_FULLDISC
- [oss-security] 20210920 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0005 mailing-list, x_refsource_MLIST
- FEDORA-2021-c00e45b6c0 vendor-advisory, x_refsource_FEDORA
- 20210921 APPLE-SA-2021-09-20-6 Additional information for APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8 mailing-list, x_refsource_FULLDISC
- 20210921 APPLE-SA-2021-09-20-7 Additional information for APPLE-SA-2021-09-13-3 macOS Big Sur 11.6 mailing-list, x_refsource_FULLDISC
- DSA-4975 vendor-advisory, x_refsource_DEBIAN
- DSA-4976 vendor-advisory, x_refsource_DEBIAN
- https://support.apple.com/kb/HT212824 x_refsource_CONFIRM
- 20210924 APPLE-SA-2021-09-23-1 iOS 12.5.5 mailing-list, x_refsource_FULLDISC
- FEDORA-2021-edf6957b7d vendor-advisory, x_refsource_FEDORA
- [oss-security] 20211026 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006 mailing-list, x_refsource_MLIST
- [oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006 mailing-list, x_refsource_MLIST
- [oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006 mailing-list, x_refsource_MLIST
- [oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006 mailing-list, x_refsource_MLIST
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30858 government-resource