CVE-2021-30762
Apple iOS WebKit Use-After-Free Vulnerability
Description
CVE-2021-30762 is a high-severity use-after-free vulnerability in Apple iOS WebKit. The flaw allows an attacker to execute arbitrary code by processing maliciously crafted web content through a WebKit-based HTML parser, including Apple Safari and other products that rely on WebKit. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. With an EPSS score of 0.05% (15.0th percentile), CVE-2021-30762 targets older iOS devices and represents a significant remote code execution threat.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | iphone os | < 12.5.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT212548(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30762(Third Party Advisory, US Government Resource)
Weakness Type
CWE-416: Use After Free
Use After Free (UAF) occurs when software continues to use a pointer after the memory it references has been freed. In CVE-2021-30762, a use-after-free condition in WebKit's memory management allows maliciously crafted web content to trigger access to freed memory, which an attacker can manipulate to achieve arbitrary code execution on affected iOS devices.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2021-30762 carries a CVSS 3.1 score of 8.8 (HIGH), indicating a serious threat to affected devices. The vulnerability is remotely exploitable over the network with low attack complexity and requires no authentication. User interaction is required, meaning a victim must visit a malicious webpage or process attacker-controlled web content. Successful exploitation results in high impact to confidentiality, integrity, and availability, as the attacker achieves arbitrary code execution within the context of the WebKit process. Apple acknowledged that this vulnerability may have been actively exploited, particularly against older iOS devices running versions prior to iOS 12.5.4.
Exploit Maturity
CVE-2021-30762 is confirmed as actively exploited through its inclusion in the CISA Known Exploited Vulnerabilities catalog. Apple has acknowledged reports of active exploitation in the wild. The EPSS score of 0.05% (15.0th percentile) indicates a lower baseline exploitation probability, but the confirmed active exploitation status demonstrates that targeted attacks have successfully leveraged this vulnerability. No public exploit code was identified in the available references. Federal agencies were required to remediate by 2021-11-17 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Update affected devices to iOS 12.5.4 or later.
- Since this vulnerability specifically targets older iOS devices (those limited to the iOS 12 branch), ensure that all legacy iPhones and iPads receive the iOS 12.5.4 update.
- For devices that cannot be updated, restrict web browsing to trusted sites and consider deploying a managed web browser with content filtering to block access to potentially malicious web content.
- Monitor web traffic for indicators of WebKit exploitation attempts, including suspicious JavaScript patterns and unexpected memory allocation behavior in browser processes.
- Implement network-level protections such as web content filtering and DNS-based threat prevention to reduce the risk of users encountering malicious web pages that exploit this vulnerability.
Technical Details
CVE-2021-30762 is a use-after-free vulnerability in Apple's WebKit rendering engine. The flaw exists in WebKit's memory management, where freed memory can still be accessed through a dangling pointer during the processing of web content. According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the vulnerability is network-accessible with low complexity, requires no privileges but needs user interaction. By crafting specific web content that triggers the use-after-free condition, an attacker can manipulate the heap to place controlled data in the freed memory region, ultimately redirecting execution flow to achieve arbitrary code execution. Apple addressed this issue with improved memory management in iOS 12.5.4.
Frequently Asked Questions
Is CVE-2021-30762 being actively exploited?
Yes. CVE-2021-30762 is listed in the CISA Known Exploited Vulnerabilities catalog, and Apple has acknowledged reports that this issue may have been actively exploited in the wild.
What products are affected by CVE-2021-30762?
CVE-2021-30762 affects Apple iPhone OS versions prior to 12.5.4. This vulnerability specifically targets older iOS devices that are limited to the iOS 12 branch and impacts any application using WebKit for HTML rendering.
How do I fix CVE-2021-30762?
Apply updates per vendor instructions. Update affected devices to iOS 12.5.4 or later. For devices that cannot be updated, restrict web browsing and implement network-level content filtering to mitigate exposure.
How severe is CVE-2021-30762?
CVE-2021-30762 has a CVSS 3.1 score of 8.8 (HIGH). It is a remotely exploitable use-after-free vulnerability in WebKit that enables arbitrary code execution through malicious web content, with confirmed active exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.