CVE-2021-30661
Apple Multiple Products WebKit Storage Use-After-Free Vulnerability
Description
CVE-2021-30661 is a high-severity use-after-free vulnerability in Apple WebKit Storage affecting iOS, iPadOS, macOS, tvOS, watchOS, and Safari. The flaw allows an attacker to execute arbitrary code by processing maliciously crafted web content through WebKit's storage component. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. With an EPSS score of 0.16% (36.6th percentile), CVE-2021-30661 represents a significant remote code execution threat across the entire Apple device ecosystem.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | safari | < 14.1 |
| apple | ipados | < 14.5 |
| apple | iphone os | < 12.5.3; >= 14.0, < 14.5 |
| apple | macos | >= 11.0, < 11.3 |
| apple | tvos | < 14.5 |
| apple | watchos | < 7.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT212317(Vendor Advisory)
- https://support.apple.com/en-us/HT212318(Vendor Advisory)
- https://support.apple.com/en-us/HT212323(Vendor Advisory)
- https://support.apple.com/en-us/HT212324(Vendor Advisory)
- https://support.apple.com/en-us/HT212325(Vendor Advisory)
- https://support.apple.com/en-us/HT212341(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30661(Third Party Advisory, US Government Resource)
Weakness Type
CWE-416: Use After Free
Use After Free (UAF) occurs when software continues to use a pointer after the memory it references has been freed. In CVE-2021-30661, a use-after-free condition in WebKit's storage component allows maliciously crafted web content to trigger access to freed memory, which an attacker can manipulate to achieve arbitrary code execution on affected devices.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2021-30661 carries a CVSS 3.1 score of 8.8 (HIGH), indicating a severe threat across the broad Apple ecosystem. The vulnerability is remotely exploitable over the network with low attack complexity and requires no authentication, though user interaction is needed. Successful exploitation results in high impact to confidentiality, integrity, and availability, granting the attacker arbitrary code execution within the WebKit process context. The wide range of affected products — including Safari, iOS, iPadOS, macOS, tvOS, and watchOS — significantly amplifies the risk exposure. Apple has acknowledged that this issue may have been actively exploited.
Exploit Maturity
CVE-2021-30661 is confirmed as actively exploited through its inclusion in the CISA Known Exploited Vulnerabilities catalog. Apple has acknowledged reports that this issue may have been actively exploited in the wild. The EPSS score of 0.16% (36.6th percentile) indicates a lower baseline exploitation probability, but the confirmed active exploitation demonstrates that targeted attacks have successfully leveraged this vulnerability. No public exploit code was identified in the available references. Federal agencies were required to remediate by 2021-11-17 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Update to Safari 14.1, iOS 14.5/iPadOS 14.5, iOS 12.5.3, macOS Big Sur 11.3, tvOS 14.5, or watchOS 7.4.
- For older iOS devices limited to the iOS 12 branch, ensure iOS 12.5.3 is installed. For all other Apple devices, update to the latest available version for your platform.
- Restrict web browsing on managed devices to trusted sites using web content filtering profiles, and deploy managed browser configurations that limit exposure to untrusted web content.
- Monitor WebKit-based application processes for signs of exploitation, including unexpected child processes, anomalous memory access patterns, and unusual storage component behavior.
- Implement network-level protections including web proxy inspection and DNS-based threat prevention to detect and block delivery of malicious web content targeting WebKit storage vulnerabilities.
Technical Details
CVE-2021-30661 is a use-after-free vulnerability in WebKit's storage component that affects the entire Apple ecosystem. The flaw resides in how WebKit manages memory for storage-related objects during web content processing. According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the vulnerability is network-accessible with low complexity, requires no privileges but needs user interaction. When a user processes malicious web content, the storage component frees a memory object but a reference to that object persists. An attacker can exploit this dangling pointer by controlling the data that occupies the freed memory region, redirecting execution flow to achieve arbitrary code execution. Apple addressed this issue with improved memory management across Safari 14.1, iOS 14.5, iPadOS 14.5, iOS 12.5.3, watchOS 7.4, tvOS 14.5, and macOS Big Sur 11.3.
Frequently Asked Questions
Is CVE-2021-30661 being actively exploited?
Yes. CVE-2021-30661 is listed in the CISA Known Exploited Vulnerabilities catalog, and Apple has acknowledged reports that this issue may have been actively exploited in the wild.
What products are affected by CVE-2021-30661?
CVE-2021-30661 affects a broad range of Apple products: Safari (< 14.1), iPadOS (< 14.5), iPhone OS (< 12.5.3; >= 14.0, < 14.5), macOS (>= 11.0, < 11.3), tvOS (< 14.5), and watchOS (< 7.4).
How do I fix CVE-2021-30661?
Apply updates per vendor instructions. Update to Safari 14.1, iOS 14.5/iPadOS 14.5, iOS 12.5.3, macOS Big Sur 11.3, tvOS 14.5, or watchOS 7.4. For devices that cannot be updated, restrict web browsing and implement content filtering.
How severe is CVE-2021-30661?
CVE-2021-30661 has a CVSS 3.1 score of 8.8 (HIGH). It is a remotely exploitable use-after-free in WebKit's storage component enabling arbitrary code execution, with confirmed active exploitation across the entire Apple ecosystem.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.