CVE-2021-30663
Apple Multiple Products WebKit Integer Overflow Vulnerability
Description
CVE-2021-30663 is a HIGH Multiple Products WebKit Integer Overflow Vulnerability affecting Apple Multiple Products, carrying a CVSS 3.1 score of 8.8. An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Affected products include Safari (< 14.1.1), Ipados (>= 14.0, < 14.5.1), Iphone Os (< 12.5.3; >= 14.0, < 14.5.1), Macos (>= 11.0, < 11.3.1), Tvos (< 14.6). This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. With an EPSS score of 0.01108 (77.92th percentile), this vulnerability shows moderate exploitation probability and warrants prompt attention.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | safari | < 14.1.1 |
| apple | ipados | >= 14.0, < 14.5.1 |
| apple | iphone os | < 12.5.3; >= 14.0, < 14.5.1 |
| apple | macos | >= 11.0, < 11.3.1 |
| apple | tvos | < 14.6 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT212335(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT212336(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT212341(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT212532(Release Notes, Vendor Advisory)
- https://support.apple.com/en-us/HT212534(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30663(Third Party Advisory, US Government Resource)
Weakness Type
CWE-190: Integer Overflow or Wraparound
CVE-2021-30663 is classified under CWE-190 — Integer Overflow or Wraparound. Integer Overflow or Wraparound occurs when a product performs a calculation that can produce an integer overflow or wraparound, using the result to control memory allocation, loop iteration, or other critical operations. When the mathematical operation exceeds the maximum or minimum value of the integer type, it wraps around to an unexpected value, leading to buffer overflows, incorrect memory allocations, or logic errors.
In the context of Apple Multiple Products, this weakness is particularly dangerous because integer overflow vulnerabilities in web content processing engines can be triggered remotely through maliciously crafted web pages. When the integer overflow occurs during buffer size calculations, subsequent memory operations use an incorrectly sized buffer, enabling attackers to write beyond allocated boundaries. This primitive is commonly chained with heap manipulation techniques to achieve reliable code execution across affected platforms.
Learn more: CWE-190 — Integer Overflow or Wraparound
Impact Analysis
CVE-2021-30663 carries a CVSS 3.1 score of 8.8 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker extensive access to sensitive data processed by Apple Multiple Products, including protected system information, user data, and potentially credentials or tokens stored within the affected environment.
Integrity (HIGH): Attackers can modify critical system files, bypass security controls, alter configurations, or deploy malicious payloads on affected Apple Multiple Products systems.
Availability (HIGH): Complete disruption of the affected service or system is possible, including denial of service, system crashes, or rendering Apple Multiple Products inoperable.
Scope Unchanged: The vulnerability's scope is Unchanged (U), meaning exploitation is contained within the vulnerable component. The impact, while significant, is limited to the Apple Multiple Products environment itself.
With an EPSS score of 0.01108 (77.92th percentile), this vulnerability demonstrates notable exploitation probability and warrants prompt remediation.
Exploit Maturity
CVE-2021-30663 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability has been actively exploited, as confirmed by its inclusion in the KEV catalog. The EPSS score of 0.01108 (77.92th percentile) confirms significant exploitation activity.
Ransomware association: As of the latest KEV data, no direct ransomware association has been confirmed for CVE-2021-30663. However, the confirmed exploitation in the wild means threat actors are actively using this vulnerability in attacks.
Attack surface: The network-based attack vector significantly broadens the attack surface, as any system with network exposure running affected versions is potentially vulnerable. Remote exploitation without physical access makes this particularly dangerous for internet-facing deployments.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2021-11-17. All organizations should treat this deadline as a strong recommendation for their own remediation timelines.
Remediation
- Apply vendor patches immediately. Apply updates per vendor instructions. Consult the vendor advisory for specific patch guidance and verify the patch addresses CVE-2021-30663 in your specific product version.
- Verify affected product versions in your environment. Identify all instances of Apple Multiple Products in your infrastructure (affected versions: Safari (< 14.1.1), Ipados (>= 14.0, < 14.5.1), Iphone Os (< 12.5.3; >= 14.0, < 14.5.1), Macos (>= 11.0, < 11.3.1), Tvos (< 14.6)). Use asset inventory and vulnerability scanning tools to ensure no instances are missed.
- Implement interim mitigations if patching is delayed. If immediate patching is not feasible, apply compensating controls such as restricting access to the affected component, enabling enhanced logging and monitoring, and enforcing least-privilege principles for running applications.
- Scan for signs of prior exploitation. Given the confirmed active exploitation of this vulnerability, review system logs and security monitoring data for evidence of compromise. Conduct a thorough investigation if any suspicious activity is detected.
- Update detection signatures and monitoring rules. Ensure intrusion detection and prevention systems, endpoint detection tools, and SIEM rules are updated to detect exploitation attempts targeting CVE-2021-30663.
- Conduct a post-remediation review. After patching, verify the fix is effective and document the remediation actions taken. Update your vulnerability management records and assess whether any additional hardening measures are warranted.
Technical Details
CVE-2021-30663 is a HIGH-severity vulnerability in Apple Multiple Products that can be exploited remotely over the network without physical access. The attack complexity is low, meaning no specialized conditions or preparation are required beyond the attack prerequisites. No prior authentication or privileges are needed to initiate the attack. User interaction is required, meaning a victim must perform an action such as opening a file, clicking a link, or visiting a website for exploitation to succeed.
Technical mechanism: An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. The underlying flaw relates to integer overflow or wraparound, where integer Overflow or Wraparound occurs when a product performs a calculation that can produce an integer overflow or wraparound, using the result to control memory allocation, loop iteration, or other critical operations. When the mathematical operation exceeds the maximum or minimum value of the integer type, it wraps around to an unexpected value, leading to buffer overflows, incorrect memory allocations, or logic errors.
Affected products: Apple Safari (< 14.1.1), Apple Ipados (>= 14.0, < 14.5.1), Apple Iphone Os (< 12.5.3; >= 14.0, < 14.5.1), Apple Macos (>= 11.0, < 11.3.1), Apple Tvos (< 14.6)
CVSS 3.1 vector analysis: The vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects an Attack Vector of NETWORK, Attack Complexity of LOW, Privileges Required of NONE, User Interaction of REQUIRED, Scope UNCHANGED, and impact ratings of HIGH/HIGH/HIGH for Confidentiality/Integrity/Availability respectively.
Frequently Asked Questions
What is CVE-2021-30663?
CVE-2021-30663 is a HIGH-severity vulnerability (CVSS 8.8) in Apple Multiple Products. Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain an integer overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. It is listed in CISA's Known Exploited Vulnerabilities catalog, confirming real-world exploitation.
Which products are affected by CVE-2021-30663?
The affected products include Safari (< 14.1.1), Ipados (>= 14.0, < 14.5.1), Iphone Os (< 12.5.3; >= 14.0, < 14.5.1), Macos (>= 11.0, < 11.3.1), Tvos (< 14.6). Organizations running any of these versions should verify their exposure and prioritize remediation. Check vendor advisories for the complete and most current list of affected versions.
How do I fix CVE-2021-30663?
Apply updates per vendor instructions. Ensure all affected instances of Apple Multiple Products are identified using vulnerability scanning and asset management tools. If immediate patching is not possible, implement compensating controls and enhanced monitoring. After patching, verify the fix and scan for indicators of prior compromise.
How severe is CVE-2021-30663?
CVE-2021-30663 is rated HIGH with a CVSS 3.1 score of 8.8. Its EPSS score of 0.01108 places it in the 77.92th percentile for exploitation likelihood. The vulnerability has confirmed active exploitation in the wild and was required to be remediated by federal agencies by 2021-11-17 per CISA's KEV directive.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.