CVE-2020-27950
Apple Multiple Products Memory Initialization Vulnerability
Description
CVE-2020-27950 is a medium-severity memory initialization vulnerability in Apple iOS, iPadOS, macOS, and watchOS that allows a malicious application to disclose kernel memory. The vulnerability stems from improper memory initialization in the XNU kernel's Mach message handling, enabling an attacker to read sensitive kernel memory contents. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, confirming active exploitation. With an EPSS score of 46.23% (97.6th percentile), CVE-2020-27950 has a very high exploitation probability despite its medium CVSS severity rating.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 14.2 |
| apple | iphone os | < 12.4.9; >= 14.0, < 14.2 |
| apple | macos | < 10.15.7; >= 11.0, < 11.0.1 |
| apple | watchos | < 5.3.9; >= 6.0, < 6.2.9; >= 7.0, < 7.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- http://packetstormsecurity.com/files/161296/XNU-Kernel-Mach-Message-Trailers-Memory-Disclosure.html(Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2020/Dec/32(Mailing List, Third Party Advisory)
- https://support.apple.com/en-us/HT211928(Vendor Advisory)
- https://support.apple.com/en-us/HT211929(Vendor Advisory)
- https://support.apple.com/en-us/HT211931(Vendor Advisory)
- https://support.apple.com/en-us/HT211940(Vendor Advisory)
- https://support.apple.com/en-us/HT211944(Vendor Advisory)
- https://support.apple.com/en-us/HT211945(Vendor Advisory)
- https://support.apple.com/en-us/HT211946(Vendor Advisory)
- https://support.apple.com/en-us/HT211947(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-27950(US Government Resource)
Weakness Type
CWE-665: Improper Initialization
Improper Initialization occurs when an application does not properly initialize critical variables, data structures, or resources before use. In CVE-2020-27950, the Apple XNU kernel fails to properly initialize memory in Mach message trailer handling, leaving residual kernel memory contents that can be read by a malicious application, effectively leaking sensitive kernel address space information.
Learn more: CWE-665 — Improper Initialization
Impact Analysis
CVE-2020-27950 carries a CVSS 3.1 score of 5.5 (MEDIUM), which may understate its real-world significance when considered as part of an exploit chain. The attack vector is local, requiring a malicious application on the device, with low attack complexity and no privileges required, though user interaction is needed. Confidentiality (High): the vulnerability exposes kernel memory contents, which can reveal kernel ASLR offsets, pointer values, and other sensitive information critical for developing kernel exploits. Integrity (None): the vulnerability does not allow data modification. Availability (None): the vulnerability does not cause service disruption. While the direct impact is limited to information disclosure, this vulnerability is extremely valuable as a building block in exploit chains, as kernel memory disclosure enables bypassing KASLR and other kernel protections. The EPSS score of 46.23% confirms very high exploitation activity.
Exploit Maturity
CVE-2020-27950 is confirmed as actively exploited, with exploit-related resources available through Packet Storm Security. CISA has included this vulnerability in the Known Exploited Vulnerabilities catalog, with federal agencies required to remediate by 2022-05-03. The EPSS score of 46.23% (97.6th percentile) indicates very high exploitation probability. CVE-2020-27950 was reported alongside CVE-2020-27930 (FontParser memory corruption) and CVE-2020-27932 (kernel privilege escalation), forming a complete exploit chain: initial code execution via malicious font, kernel memory disclosure to bypass KASLR, and kernel privilege escalation for full device compromise.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Update Apple iOS to 14.2 or later (or 12.4.9 for older devices), iPadOS to 14.2 or later, macOS to 10.15.7 (with Supplemental Update) or 11.0.1, and apply Security Update 2020-006 for High Sierra and Mojave. Update watchOS to 7.1 (or 6.2.9/5.3.9 for older models).
- Verify all Apple devices are updated, paying special attention to older devices still on iOS 12, watchOS 5, or watchOS 6. Implement MDM policies enforcing minimum OS versions.
- As an interim mitigation, restrict application installations to trusted sources and implement application whitelisting to prevent malicious apps from running on devices.
- Monitor for indicators of the full exploit chain (CVE-2020-27930/27950/27932), including unusual application crashes, unexpected kernel panic logs, signs of jailbreaking, and unauthorized process escalation.
- Deploy endpoint detection solutions capable of monitoring for kernel-level exploitation attempts and implement network monitoring to detect command-and-control traffic from compromised devices.
Technical Details
CVE-2020-27950 is a memory initialization vulnerability in the Apple XNU kernel's Mach message trailer handling. The vulnerability was addressed with improved memory initialization in the patched versions. When the kernel processes Mach messages, it constructs message trailers that may contain uninitialized memory regions from the kernel heap. A malicious application can craft specific Mach message requests that cause the kernel to return these trailers with residual kernel memory contents, effectively disclosing kernel address space information. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects the local attack vector with high confidentiality impact but no integrity or availability impact, as this is purely an information disclosure vulnerability. However, the disclosed kernel memory typically contains KASLR offsets and pointer values that are prerequisites for reliable kernel exploitation.
Frequently Asked Questions
Is CVE-2020-27950 being actively exploited?
Yes. CVE-2020-27950 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 46.23% (97.6th percentile) indicates very high exploitation probability. It was likely chained with CVE-2020-27930 and CVE-2020-27932 for full device compromise.
What products are affected by CVE-2020-27950?
CVE-2020-27950 affects Apple iOS (< 12.4.9; >= 14.0, < 14.2), iPadOS (< 14.2), macOS (< 10.15.7; >= 11.0, < 11.0.1), and watchOS (< 5.3.9; >= 6.0, < 6.2.9; >= 7.0, < 7.1).
How do I fix CVE-2020-27950?
Update Apple iOS to 14.2+ (or 12.4.9 for older devices), iPadOS to 14.2+, macOS to 10.15.7+ (with Supplemental Update) or 11.0.1+, and watchOS to 7.1+ (or 6.2.9/5.3.9 for older models).
How severe is CVE-2020-27950?
CVE-2020-27950 has a CVSS 3.1 score of 5.5 (MEDIUM), but its real-world impact is significant as it enables kernel memory disclosure that bypasses KASLR, making it a critical component in exploit chains for full device compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.