CVE-2020-9907
Apple Multiple Products Memory Corruption Vulnerability
Description
CVE-2020-9907 is a memory corruption vulnerability affecting Apple iOS, iPadOS, and tvOS that could allow a malicious application to execute arbitrary code with kernel privileges. The flaw resides in the kernel's memory handling, where improper management of memory objects enables an attacker to corrupt kernel data structures and achieve the highest level of system access. CISA has added CVE-2020-9907 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 0.61% (69.4th percentile), this vulnerability is primarily associated with targeted exploitation campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 13.6 |
| apple | iphone os | < 13.6 |
| apple | tvos | < 13.4.8 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/HT211288(Release Notes, Vendor Advisory)
- https://support.apple.com/HT211290(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-9907(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CVE-2020-9907 involves memory corruption in the Apple kernel that enables out-of-bounds write operations. The vulnerability allows a malicious application to trigger memory corruption in the kernel by exploiting a flaw in how the kernel manages memory objects, resulting in writes beyond allocated buffer boundaries that can overwrite critical kernel data structures.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2020-9907 enables kernel-level code execution on Apple iOS, iPadOS, and tvOS devices. The vulnerability requires a malicious application as the local attack vector, but the kernel-level impact makes it an extremely valuable privilege escalation component. Once kernel access is achieved, the attacker bypasses all application sandboxing and security boundaries on the device. Confidentiality is fully compromised as kernel access provides unrestricted access to all data stored on the device; integrity is completely at risk as the attacker can modify any system component including security configurations; and availability can be disrupted through persistent kernel-level modifications. While the EPSS score of 0.61% (69.4th percentile) indicates that mass exploitation is unlikely, the confirmed KEV status demonstrates real-world use in targeted attacks against Apple mobile device users.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2020-9907 in the wild by adding it to the Known Exploited Vulnerabilities catalog on June 27, 2022, with a remediation deadline of July 18, 2022. With an EPSS score of 0.61% (69.4th percentile), the vulnerability is not subject to widespread automated exploitation, but rather targeted campaigns. Apple kernel memory corruption vulnerabilities are highly valued in the exploit ecosystem and are typically leveraged by sophisticated threat actors for surveillance tool deployment and persistent device compromise. The targeted nature of exploitation is consistent with the sophistication required to develop reliable iOS kernel exploits.
Remediation
- Update all affected Apple devices immediately: Install the security updates for iOS, iPadOS, and tvOS that contain the fix for CVE-2020-9907. The vulnerability was addressed in updates released in mid-2020.
- Enable automatic security updates: Configure all Apple devices to automatically install security updates to minimize the exposure window for kernel vulnerabilities.
- Restrict application installation sources: Implement MDM policies to prevent installation of applications from untrusted sources, as a locally installed malicious application is required for exploitation.
- Enable Lockdown Mode for high-risk users: For individuals who may be targets of state-sponsored surveillance, Apple's Lockdown Mode provides additional protections that reduce the kernel attack surface.
- Monitor managed Apple devices for compromise indicators: Deploy mobile threat detection solutions and monitor for unusual device behavior such as unexpected reboots, battery drain, or data exfiltration patterns that may indicate kernel-level exploitation.
Technical Details
CVE-2020-9907 is a memory corruption vulnerability in the kernel shared by Apple iOS, iPadOS, and tvOS. The vulnerability arises from improper handling of memory objects within the kernel, where a flaw in the memory management logic allows a malicious application to trigger corruption of kernel memory structures. By carefully controlling the memory corruption, an attacker can overwrite kernel data such as function pointers, process credentials, or memory management metadata to achieve arbitrary code execution at the kernel privilege level. The local attack vector means the attacker must first deploy a malicious application on the target device, which is typically achieved through a separate browser-based or social engineering exploit. Once kernel access is obtained, the attacker can install persistent surveillance tools, bypass code signing enforcement, and access all data on the device regardless of encryption or application-level protections.
Frequently Asked Questions
Is CVE-2020-9907 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2020-9907 by adding it to the Known Exploited Vulnerabilities catalog. The vulnerability is used in targeted attacks against Apple device users. All affected devices should be updated to the patched firmware versions.
What products are affected by CVE-2020-9907?
CVE-2020-9907 affects Apple iOS, iPadOS, and tvOS. This includes iPhones, iPads, and Apple TV devices running firmware versions prior to the security updates released in mid-2020.
How do I fix CVE-2020-9907?
Update all affected Apple devices to the security updates released in mid-2020 that address CVE-2020-9907. Enable automatic security updates on all devices. Implement MDM restrictions on application installation from untrusted sources.
How severe is CVE-2020-9907?
CVE-2020-9907 is a high-severity kernel memory corruption vulnerability with an EPSS score of 0.61% (69.4th percentile) and confirmed active exploitation. While exploitation requires a local malicious application, the kernel-level code execution provides complete control over affected iOS, iPadOS, and tvOS devices, making it a critical priority for organizations managing Apple device fleets.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.