CVE-2021-30807: Apple Multiple Products Memory Corruption Vulnerability

Q: What is CVE-2021-30807 vulnerability?

CVE-2021-30807 is a memory corruption issue in Apple Multiple Products that allows an application to execute arbitrary code with kernel privileges.

Q: Which Apple products are affected by CVE-2021-30807?

Apple iOS, iPadOS, macOS, and watchOS are affected by CVE-2021-30807.

Q: What is the severity of CVE-2021-30807?

CVE-2021-30807 has a severity rating of 7.8 (critical).

Q: How can I fix CVE-2021-30807 vulnerability?

To fix CVE-2021-30807, update your software to the fixed versions: macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1.

Q: Where can I find more information about CVE-2021-30807?

You can find more information about CVE-2021-30807 on Apple's website: [support.apple.com](https://support.apple.com/en-us/HT212622) and [support.apple.com](https://support.apple.com/en-us/HT212623), [support.apple.com](https://support.apple.com/en-us/HT212713).

Published Jul 26, 2021

Updated

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.

Other sources

Apple iOS, iPadOS, macOS, and watchOS IOMobileFrameBuffer contain a memory corruption vulnerability which may allow an application to execute code with kernel privileges.

— CISA

IOMobileFrameBuffer. A memory corruption issue was addressed with improved memory handling.

Credit

an anonymous researcher, an anonymous researcher, an anonymous researcher

Affected Software

10 affected componentsFixes available

Apple Multiple Products

Apple macOS Big Sur<11.5.1

11.5.1

Apple WatchOS<7.6.1

7.6.1

Apple Ipad Os<14.7.1

Apple iPhone OS<14.7.1

Apple macOS<11.5.1

Apple WatchOS<7.6.1

Apple iOS<14.7.1

14.7.1

Apple iPadOS<14.7.1

14.7.1

Apple iPadOS<14.7.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apple macOS to a version that resolves this vulnerability.
Fixed in 11.5.1
Upgrade
Upgrade Apple iOS, iPadOS, and watchOS to a version that resolves this vulnerability.
Fixed in 7.6.1
Upgrade
Upgrade Apple iOS and iPadOS to a version that resolves this vulnerability.
Fixed in 14.7.1
Upgrade
Upgrade Apple iOS, iPadOS, and macOS to a version that resolves this vulnerability.
Fixed in 14.7.1
Upgrade
Upgrade Apple iOS to a version that resolves this vulnerability.
Fixed in 14.7.1
Upgrade
Upgrade Apple iPadOS to a version that resolves this vulnerability.
Fixed in 14.7.1
Upgrade
Upgrade macOS Big Sur to a version that resolves this vulnerability.
Fixed in 11.5.1
Upgrade
Upgrade watchOS to a version that resolves this vulnerability.
Fixed in 7.6.1

Event History

Oct 19, 2021

CVE Published

via MITRE·01:12 PM

Data Sourced

via MITRE·01:12 PM

DescriptionWeakness

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Nov 3, 2021

Known Exploited

via CISA·12:00 AM

Oct 17, 58448

Event

05:08 PM

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

CVE-2021-30807

Frequently Asked Questions

What is CVE-2021-30807 vulnerability?