CVE-2020-27930
Apple Multiple Products Memory Corruption Vulnerability
Description
CVE-2020-27930 is a HIGH severity memory corruption vulnerability in Apple's FontParser component affecting iOS, iPadOS, macOS, and watchOS. The flaw exists in the processing of font files, where a maliciously crafted font can trigger memory corruption leading to arbitrary code execution. With a CVSS 3.1 score of 7.8, this vulnerability was exploited in the wild as part of a chained attack alongside CVE-2020-27950 (kernel memory disclosure) and CVE-2020-27932 (kernel privilege escalation). It affects iOS before 14.2 and 12.4.9, iPadOS before 14.2, macOS before Big Sur 11.0.1 and Catalina 10.15.7 Supplemental Update, and multiple watchOS versions. CISA added CVE-2020-27930 to its KEV catalog on November 3, 2021. The EPSS score of 0.47173 (97.63rd percentile) indicates a very high exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 14.2 |
| apple | iphone os | < 12.4.9; >= 14.0, < 14.2 |
| apple | mac os x | < 10.15.7 |
| apple | macos | >= 11.0, < 11.0.1 |
| apple | watchos | < 5.3.9; >= 6.0, < 6.2.9; >= 7.0, < 7.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/161294/Apple-Safari-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2020/Dec/32(Mailing List, Third Party Advisory)
- https://support.apple.com/en-us/HT211928(Vendor Advisory)
- https://support.apple.com/en-us/HT211929(Vendor Advisory)
- https://support.apple.com/en-us/HT211931(Vendor Advisory)
- https://support.apple.com/en-us/HT211940(Vendor Advisory)
- https://support.apple.com/en-us/HT211944(Vendor Advisory)
- https://support.apple.com/en-us/HT211945(Vendor Advisory)
- https://support.apple.com/en-us/HT211946(Vendor Advisory)
- https://support.apple.com/en-us/HT211947(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-27930(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
Out-of-bounds Write is a vulnerability that occurs when software writes data to a memory location outside the intended boundaries of a buffer. This can happen through buffer overflows, incorrect array indexing, pointer arithmetic errors, or integer overflows affecting size calculations. Out-of-bounds writes are extremely dangerous as they can corrupt adjacent data, overwrite control flow information, modify security flags, or corrupt heap metadata. This vulnerability consistently ranks as one of the most dangerous software weaknesses.
In the context of CVE-2020-27930, the out-of-bounds write occurs in Apple's FontParser library during the processing of maliciously crafted font data. FontParser is responsible for parsing and rendering various font formats including TrueType and OpenType fonts. The vulnerability is triggered when FontParser processes a specially crafted font file containing malformed glyph data or font table entries. The corrupted font data causes the parser to write beyond allocated buffer boundaries, overwriting adjacent heap memory. Attackers can craft the font data to precisely control what is written and where, enabling them to corrupt function pointers or other control data structures to redirect execution flow. This vulnerability was exploited via Safari as the initial entry point, where visiting a malicious webpage containing the crafted font triggered the memory corruption.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2020-27930 carries a CVSS 3.1 base score of 7.8 (HIGH) with local attack characteristics.
Confidentiality (High): Successful exploitation enables arbitrary code execution in the context of the process parsing the malicious font. When exploited through Safari, this provides access to browser data including cookies, saved passwords, browsing history, and any data accessible to the browser sandbox. When chained with the kernel vulnerabilities CVE-2020-27950 and CVE-2020-27932, the attacker achieves full device access including all stored data, messages, credentials, and media files.
Integrity (High): Arbitrary code execution allows the attacker to modify files, install persistent backdoors, alter system configurations, and tamper with application data. The chained exploitation path enables kernel-level modifications that can survive application restarts and potentially persist across reboots through additional exploitation techniques.
Availability (High): The memory corruption can cause application crashes during exploitation attempts. Successful exploitation grants the attacker the ability to terminate processes, corrupt system files, or render the device unusable. The attacker has sufficient control to disrupt any service on the compromised device.
Scope (Unchanged): The vulnerability initially affects the FontParser process context. However, when combined with the companion kernel vulnerabilities (CVE-2020-27950 and CVE-2020-27932), the scope effectively extends to full device compromise with kernel-level control.
Exploit Maturity
Active Exploitation: CVE-2020-27930 was actively exploited in the wild as part of a sophisticated three-vulnerability attack chain. Apple confirmed awareness of active exploitation in its security advisory. CISA added this vulnerability to the KEV catalog on November 3, 2021, with a remediation deadline of May 3, 2022.
Exploit Chain: The exploitation was observed as part of a three-bug chain targeting Apple devices. CVE-2020-27930 (FontParser memory corruption) served as the initial entry vector, typically through a malicious webpage loaded in Safari. CVE-2020-27950 (kernel memory disclosure) was then used to leak kernel memory addresses needed to bypass KASLR. Finally, CVE-2020-27932 (kernel type confusion) was used to achieve kernel-level code execution with full device control.
Public Exploits: A proof-of-concept exploit for the Safari remote code execution component was published on Packet Storm Security, demonstrating the FontParser exploitation through a crafted webpage. This lowered the barrier for independent exploitation.
Ransomware Association: CISA's KEV catalog does not indicate a known ransomware association for this vulnerability.
EPSS Context: The EPSS score of 0.47173 (97.63rd percentile) places this vulnerability in the top 2.4% of all CVEs for exploitation probability, reflecting the confirmed wild exploitation and the availability of public exploit code.
Remediation
-
Update all Apple devices to patched versions immediately. Install iOS 14.2 or later (or iOS 12.4.9 for devices that cannot run iOS 14), iPadOS 14.2 or later, macOS Big Sur 11.0.1, macOS Catalina 10.15.7 Supplemental Update, Security Update 2020-006 for High Sierra and Mojave, and watchOS 7.1, 6.2.9, or 5.3.9 as appropriate for your device.
-
Prioritize web-facing devices. Since the exploitation vector involves processing malicious fonts through web browsers (Safari), devices used for web browsing and email should receive the highest patching priority. This includes all iPhones, iPads, and Macs with regular internet access.
-
Deploy content filtering to block malicious font delivery. Implement web content filtering at the network perimeter to inspect and block requests for suspicious font files. While this is not a complete mitigation, it can reduce the attack surface for browser-based exploitation.
-
Audit systems for indicators of compromise. Check for unexpected processes, unusual network connections, and signs of kernel-level compromise on Apple devices. Monitor for anomalous behavior that could indicate post-exploitation activity from the three-bug chain.
-
Use mobile device management for compliance enforcement. Deploy MDM policies that enforce minimum OS versions across all organizational Apple devices. Create alerts for devices that fall behind on security updates.
-
Restrict web browsing on sensitive devices. For devices handling highly sensitive data, consider restricting web browsing to approved sites or using a separate device for general internet access to minimize exposure to browser-based exploitation.
Technical Details
CVE-2020-27930 is a memory corruption vulnerability in Apple's FontParser library, which handles the parsing and rendering of font data across all Apple operating systems. The vulnerability exists in the code responsible for processing font file structures, specifically in the handling of glyph outlines and font table data.
The technical root cause is an out-of-bounds write triggered during the parsing of malformed font data. When FontParser encounters a specially crafted font file, insufficient bounds checking on glyph coordinate data or table offsets allows the parser to write data beyond the boundaries of allocated heap buffers. The attacker controls the content and placement of the out-of-bounds write through careful manipulation of the font file structure.
The exploitation vector leverages Safari's automatic font processing capability. Web pages can specify custom fonts using CSS @font-face declarations, causing the browser to download and process font files from remote servers. When a victim visits a malicious webpage, Safari automatically downloads the crafted font and passes it to FontParser for processing, triggering the memory corruption without requiring any additional user interaction beyond navigating to the page.
The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) classifies this as a local attack requiring user interaction, which in practice means visiting a malicious webpage. The attack complexity is low because the exploitation is reliable and does not require the attacker to win a race condition or overcome unpredictable environmental factors.
In the observed attack chain, CVE-2020-27930 provides initial code execution within the Safari renderer process sandbox. The attacker then uses CVE-2020-27950 to read uninitialized kernel memory and defeat KASLR (Kernel Address Space Layout Randomization). With kernel addresses known, CVE-2020-27932 is exploited for kernel-level privilege escalation, completing the device compromise.
Apple addressed the vulnerability with improved input validation in FontParser to prevent the out-of-bounds write condition when processing font data.
Frequently Asked Questions
Is CVE-2020-27930 being actively exploited?
Yes. Apple confirmed that CVE-2020-27930 was actively exploited in the wild. It was used as the initial entry point in a three-vulnerability attack chain that also included CVE-2020-27950 (kernel memory disclosure) and CVE-2020-27932 (kernel privilege escalation). CISA added the vulnerability to its KEV catalog on November 3, 2021.
What products are affected by CVE-2020-27930?
CVE-2020-27930 affects Apple iOS before 14.2 and before 12.4.9, iPadOS before 14.2, macOS before Big Sur 11.0.1 and Catalina before the 10.15.7 Supplemental Update (plus Security Update 2020-006 for High Sierra and Mojave), and watchOS before 7.1, 6.2.9, and 5.3.9.
How do I fix CVE-2020-27930?
Update to iOS 14.2+ (or iOS 12.4.9 for older devices), iPadOS 14.2+, macOS Big Sur 11.0.1+, the macOS Catalina 10.15.7 Supplemental Update, or the appropriate watchOS version. Given the browser-based exploitation vector, prioritize patching devices used for web browsing and email.
How severe is CVE-2020-27930?
CVE-2020-27930 is rated HIGH with a CVSS score of 7.8. Its severity is amplified by its role as the initial entry point in a full device compromise chain. Combined with CVE-2020-27950 and CVE-2020-27932, exploitation leads to complete kernel-level device control. The EPSS score of 0.47173 (97.63rd percentile) confirms a very high real-world exploitation probability, and a public proof-of-concept exploit is available.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.