CVE-2021-30660
📋 TL;DR
This vulnerability allows a malicious application to read kernel memory beyond intended boundaries, potentially exposing sensitive system information. It affects macOS, iOS, iPadOS, watchOS, and tvOS devices running versions before the specified security updates.
💻 Affected Systems
- macOS
- iOS
- iPadOS
- watchOS
- tvOS
📦 What is this software?
Ipados by Apple
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Tvos by Apple
Watchos by Apple
⚠️ Risk & Real-World Impact
Worst Case
An attacker could read kernel memory containing sensitive data like encryption keys, passwords, or other privileged information, potentially leading to full system compromise.
Likely Case
A malicious app could leak kernel memory contents, exposing system information that could be used for further attacks or information gathering.
If Mitigated
With proper app sandboxing and security controls, the impact is limited to information disclosure from the kernel memory space accessible to the malicious app.
🎯 Exploit Status
Exploitation requires a malicious application to be installed and executed on the target device. No public exploit code has been disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: macOS Big Sur 11.3, iOS 14.5, iPadOS 14.5, watchOS 7.4, tvOS 14.5
Vendor Advisory: https://support.apple.com/en-us/HT212317
Restart Required: Yes
Instructions:
1. Open Settings/System Preferences. 2. Navigate to Software Update. 3. Install the latest available update. 4. Restart the device when prompted.
🔧 Temporary Workarounds
Application Restriction
allRestrict installation of applications to only trusted sources and verified app stores.
🧯 If You Can't Patch
- Implement strict application control policies to prevent installation of untrusted applications
- Use mobile device management (MDM) solutions to enforce security policies and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check the operating system version against the affected versions listed in the Apple security advisories.Check Version:
macOS: sw_vers -productVersion, iOS/iPadOS: Settings > General > About > Version, watchOS: Watch app > General > About > Version, tvOS: Settings > General > About > VersionVerify Fix Applied:
Verify the device is running macOS 11.3 or later, iOS 14.5 or later, iPadOS 14.5 or later, watchOS 7.4 or later, or tvOS 14.5 or later.📡 Detection & Monitoring
Log Indicators:
- Unusual application behavior, unexpected memory access patterns, or kernel panic logs
Network Indicators:
- No network indicators as this is a local vulnerability
SIEM Query:
Search for kernel panic events or unusual process memory access patterns in system logs🔗 References
- https://support.apple.com/en-us/HT212317
- https://support.apple.com/en-us/HT212323
- https://support.apple.com/en-us/HT212324
- https://support.apple.com/en-us/HT212325
- https://support.apple.com/en-us/HT212317
- https://support.apple.com/en-us/HT212323
- https://support.apple.com/en-us/HT212324
- https://support.apple.com/en-us/HT212325
