CVE-2020-9904 – This is a memory corruption vulnerability in Ap... (How to Fix)

Q: What is the severity of CVE-2020-9904?

CVE-2020-9904 has a CVSS score of 7.8 (HIGH). This is a memory corruption vulnerability in Apple's iOS, iPadOS, macOS, tvOS, and watchOS that allows an application to execute arbitrary code with kernel privileges. Attackers could gain complete control over affected devices. All users of affected Apple operating systems are at risk.

📋 TL;DR

This is a memory corruption vulnerability in Apple's iOS, iPadOS, macOS, tvOS, and watchOS that allows an application to execute arbitrary code with kernel privileges. Attackers could gain complete control over affected devices. All users of affected Apple operating systems are at risk.

💻 Affected Systems

Products:

iOS
iPadOS
macOS Catalina
tvOS
watchOS

Versions: Versions prior to iOS 13.6, iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8

Operating Systems: iOS, iPadOS, macOS, tvOS, watchOS

Default Config Vulnerable: ⚠️ Yes

Notes: All standard configurations are vulnerable. No special configuration required for exploitation.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device compromise with kernel-level privileges, allowing attackers to install persistent malware, steal all data, and control device functions.

🟠

Likely Case

Targeted attacks against high-value individuals or organizations to gain persistent access to devices and sensitive information.

🟢

If Mitigated

Limited impact with proper network segmentation and endpoint protection, though kernel-level access remains highly dangerous.

🌐 Internet-Facing: MEDIUM

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires application execution, suggesting user interaction or social engineering is needed. Kernel privilege escalation makes this highly valuable for attackers.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: iOS 13.6, iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8

Vendor Advisory: https://support.apple.com/kb/HT211288

Restart Required: Yes

Instructions:

1. Open Settings app. 2. Go to General > Software Update. 3. Download and install the available update. 4. Restart device when prompted.

🔧 Temporary Workarounds

Application Whitelisting

all

Restrict application installation to trusted sources only to prevent malicious apps from exploiting the vulnerability.

🧯 If You Can't Patch

Isolate affected devices from critical networks and sensitive data
Implement strict application control policies and monitor for suspicious activity

🔍 How to Verify

Check if Vulnerable:

Check current OS version in device settings against affected version ranges.

Check Version:

iOS/iPadOS: Settings > General > About > Version. macOS: Apple menu > About This Mac. tvOS: Settings > General > About. watchOS: iPhone Watch app > General > About.

Verify Fix Applied:

Verify OS version matches or exceeds patched versions: iOS/iPadOS 13.6+, macOS 10.15.6+, tvOS 13.4.8+, watchOS 6.2.8+.

📡 Detection & Monitoring

Log Indicators:

Unexpected kernel extensions or modules loading
Suspicious application behavior with elevated privileges

Network Indicators:

Unusual outbound connections from Apple devices
Command and control traffic patterns

SIEM Query:

source="apple-devices" AND (event_type="kernel_extension_load" OR privilege_escalation=true)

📊 Metadata

CVE ID: CVE-2020-9904

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-787

Published: October 22, 2020

Last Updated: November 21, 2024

🔗 References

https://support.apple.com/kb/HT211288 Vendor Advisory
https://support.apple.com/kb/HT211289 Vendor Advisory
https://support.apple.com/kb/HT211290 Vendor Advisory
https://support.apple.com/kb/HT211291 Vendor Advisory
https://support.apple.com/kb/HT211288 Vendor Advisory
https://support.apple.com/kb/HT211289 Vendor Advisory
https://support.apple.com/kb/HT211290 Vendor Advisory
https://support.apple.com/kb/HT211291 Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-9904, you might also want to check these: