CVE-2020-27932
Apple Multiple Products Type Confusion Vulnerability
Description
CVE-2020-27932 is a high-severity type confusion vulnerability affecting Apple iOS, iPadOS, macOS, and watchOS. The flaw resides in the XNU kernel's handling of turnstile objects, where a type confusion issue allows a malicious application to execute arbitrary code with kernel privileges. CISA has added CVE-2020-27932 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 11.3% (93.4th percentile), this Apple kernel vulnerability poses a significant risk and demands immediate patching.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | icloud | < 11.5 |
| apple | itunes | < 12.11 |
| apple | ipados | < 14.2 |
| apple | iphone os | < 12.4.9; >= 14.0, < 14.2 |
| apple | mac os x | < 10.15.7 |
| apple | macos | >= 11.0, < 11.0.1 |
| apple | watchos | < 5.3.9; >= 6.0, < 6.2.9; >= 7.0, < 7.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/161295/XNU-Kernel-Turnstiles-Type-Confusion.html(Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2020/Dec/32(Mailing List, Third Party Advisory)
- https://support.apple.com/en-us/HT211928(Vendor Advisory)
- https://support.apple.com/en-us/HT211929(Vendor Advisory)
- https://support.apple.com/en-us/HT211931(Vendor Advisory)
- https://support.apple.com/en-us/HT211940(Vendor Advisory)
- https://support.apple.com/en-us/HT211944(Vendor Advisory)
- https://support.apple.com/en-us/HT211945(Vendor Advisory)
- https://support.apple.com/en-us/HT211946(Vendor Advisory)
- https://support.apple.com/en-us/HT211947(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-27932(US Government Resource)
Weakness Type
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
Type confusion occurs when a resource is allocated or initialized with one type but later accessed using an incompatible type. In the case of CVE-2020-27932, the Apple XNU kernel incorrectly handles type transitions for turnstile objects, allowing a malicious application to confuse the kernel into treating memory as an incompatible type, ultimately enabling arbitrary code execution with kernel privileges.
Learn more: CWE-843 — Access of Resource Using Incompatible Type ('Type Confusion')
Impact Analysis
CVE-2020-27932 carries a CVSS 3.1 score of 7.8 (HIGH), reflecting a serious threat to affected Apple devices. The vulnerability requires local access and user interaction to exploit, meaning an attacker must convince a user to run a malicious application. However, no special privileges are required to trigger the flaw. Once exploited, the impact on confidentiality, integrity, and availability is high, as the attacker gains kernel-level code execution. The EPSS score of 11.3% (93.4th percentile) indicates a high probability of active exploitation, making this vulnerability a priority for remediation across all affected Apple platforms.
Exploit Maturity
CVE-2020-27932 is confirmed as actively exploited through its inclusion in the CISA Known Exploited Vulnerabilities catalog. A public proof-of-concept related to the XNU kernel turnstiles type confusion is available via Packet Storm Security, lowering the barrier for potential attackers. The EPSS score of 11.3% (93.4th percentile) indicates a high likelihood of exploitation activity. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Install macOS Big Sur 11.0.1, iOS 14.2/iPadOS 14.2, iOS 12.4.9, watchOS 7.1/6.2.9/5.3.9, or the macOS Catalina 10.15.7 Supplemental Update.
- For devices running older iOS versions, update to at least iOS 12.4.9. For macOS systems, apply Security Update 2020-006 for High Sierra and Mojave, or update to macOS Big Sur 11.0.1.
- Restrict the installation and execution of untrusted applications through Mobile Device Management (MDM) policies and application whitelisting to reduce the attack surface.
- Monitor endpoints for indicators of compromise, including unexpected kernel panics, unusual process activity with elevated privileges, and suspicious application installations.
- Implement defense-in-depth strategies by enabling Lockdown Mode on supported devices and ensuring all kernel extensions and system integrity protections remain active.
Technical Details
CVE-2020-27932 is a type confusion vulnerability in the Apple XNU kernel related to the handling of turnstile objects. The flaw arises when the kernel processes state transitions incorrectly, allowing a resource to be accessed using an incompatible type. According to the CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), exploitation requires local access with user interaction but no privileges, and the scope remains unchanged. A malicious application can leverage this type confusion to corrupt kernel memory structures, ultimately achieving arbitrary code execution with kernel privileges. Apple addressed the issue with improved state handling across multiple operating system versions.
Frequently Asked Questions
Is CVE-2020-27932 being actively exploited?
Yes. CVE-2020-27932 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 11.3% (93.4th percentile) further indicates a high probability of exploitation.
What products are affected by CVE-2020-27932?
CVE-2020-27932 affects multiple Apple products including: iPhone OS (< 12.4.9; >= 14.0, < 14.2), iPadOS (< 14.2), macOS (>= 11.0, < 11.0.1), Mac OS X (< 10.15.7), watchOS (< 5.3.9; >= 6.0, < 6.2.9; >= 7.0, < 7.1), iCloud (< 11.5), and iTunes (< 12.11).
How do I fix CVE-2020-27932?
Apply updates per vendor instructions. Install the latest available patches for your Apple devices: iOS 14.2, iPadOS 14.2, macOS Big Sur 11.0.1, watchOS 7.1, or the appropriate security updates for older macOS versions. If immediate patching is not possible, restrict untrusted application installation via MDM policies.
How severe is CVE-2020-27932?
CVE-2020-27932 has a CVSS 3.1 score of 7.8 (HIGH). The vulnerability allows kernel-level code execution through a type confusion flaw, and its active exploitation status and high EPSS percentile (93.4th) make it a critical priority for remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.