CVE-2020-9973
📋 TL;DR
This vulnerability allows attackers to cause out-of-bounds memory reads when processing malicious USD (Universal Scene Description) files. Successful exploitation could lead to application crashes or arbitrary code execution. Affects macOS and iOS/iPadOS users who open USD files from untrusted sources.
💻 Affected Systems
- macOS
- iOS
- iPadOS
📦 What is this software?
Ipados by Apple
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the application processing the USD file, potentially leading to full system compromise.
Likely Case
Application crashes (denial of service) when processing malicious USD files, with potential for limited code execution in some scenarios.
If Mitigated
No impact if systems are fully patched or if USD file processing is restricted to trusted sources.
🎯 Exploit Status
Exploitation requires user interaction to open malicious USD file. Public technical details available in Talos Intelligence report TALOS-2020-1104.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: macOS Catalina 10.15.7, Security Update 2020-005 for High Sierra/Mojave, iOS 14.0, iPadOS 14.0
Vendor Advisory: https://support.apple.com/en-us/HT211849
Restart Required: Yes
Instructions:
1. Open System Preferences > Software Update. 2. Install available updates. 3. Restart when prompted. For iOS/iPadOS: Settings > General > Software Update.
🔧 Temporary Workarounds
Restrict USD file processing
allConfigure system to prevent automatic opening of USD files or restrict to trusted sources only.
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized applications that process USD files.
- Educate users to avoid opening USD files from untrusted sources and implement email/web filtering for USD attachments.
🔍 How to Verify
Check if Vulnerable:
Check macOS version: sw_vers -productVersion. Check iOS/iPadOS version: Settings > General > About > Version.Check Version:
macOS: sw_vers -productVersion; iOS/iPadOS: no command-line option, check in SettingsVerify Fix Applied:
Verify version is macOS 10.15.7 or later, or iOS/iPadOS 14.0 or later.📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing USD files
- Console logs showing memory access violations
Network Indicators:
- Downloads of USD files from untrusted sources
- Network transfers of suspicious USD files
SIEM Query:
source="apple_system_logs" AND (process="Preview" OR process="Finder") AND event="crash" AND file_extension="usd"🔗 References
- http://seclists.org/fulldisclosure/2020/Nov/20
- http://seclists.org/fulldisclosure/2020/Nov/21
- https://support.apple.com/en-us/HT211849
- https://support.apple.com/en-us/HT211850
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1104
- http://seclists.org/fulldisclosure/2020/Nov/20
- http://seclists.org/fulldisclosure/2020/Nov/21
- https://support.apple.com/en-us/HT211849
- https://support.apple.com/en-us/HT211850
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1104
