Actively exploited · Published Aug 24, 2021 · Assigned by apple

CVE-2021-31010

High 7.5 Exploited

In plain English

A high-severity unsafe deserialization in macOS from Apple. Attackers are actively exploiting it in the wild (listed by CISA on August 25, 2022). The chance it is exploited in the next 30 days is estimated at 3.7% (higher than 90% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)3.7%top 10.3% of all CVEs

Exploited in the wildYesCISA KEV since Aug 25, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Sep 15, 2022.

Official description

A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..

Affected products (as reported)

Vendor	Product	Versions
Apple	macOS	unspecified – before 11.6
Apple	macOS	unspecified – before 2021
Apple	watchOS	unspecified – before 7.6
Apple	watchOS	unspecified – before 14.8
Apple	watchOS	unspecified – before 12.5

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://support.apple.com/en-us/HT212804 x_refsource_MISC
https://support.apple.com/en-us/HT212805 x_refsource_MISC
https://support.apple.com/en-us/HT212807 x_refsource_MISC
https://support.apple.com/en-us/HT212806 x_refsource_MISC
https://support.apple.com/en-us/HT212824 x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31010 government-resource