CVE-2021-30869
Apple iOS, iPadOS, and macOS Type Confusion Vulnerability
Description
CVE-2021-30869 is a high-severity vulnerability affecting Apple iOS, iPadOS, and macOS. Apple iOS, iPadOS, and macOS contain a type confusion vulnerability in the XNU which may allow a malicious application to execute code with kernel privileges. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 2.00% (83.5th percentile), this vulnerability has a notable probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 14.4 |
| apple | iphone os | >= 12.0, < 12.5.5; >= 14.0, < 14.4 |
| apple | mac os x | >= 10.14, <= 10.14.6; >= 10.15, <= 10.15.6; 10.14.6; 10.15.7 |
| apple | macos | >= 11.0, < 11.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT212146(Vendor Advisory)
- https://support.apple.com/en-us/HT212147(Vendor Advisory)
- https://support.apple.com/en-us/HT212824(Vendor Advisory)
- https://support.apple.com/en-us/HT212825(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30869(US Government Resource)
Weakness Type
CWE-843: Access of Resource Using Incompatible Type (Type Confusion)
Type Confusion (CWE-843) occurs when a program allocates or initializes a resource using one type but later accesses that resource using an incompatible type. This mismatch can lead to out-of-bounds memory access, allowing attackers to execute arbitrary code or cause unexpected program behavior. In kernel-level components like XNU, type confusion vulnerabilities are particularly dangerous because they can enable privilege escalation from user space to kernel space.
Learn more: CWE-843 — Access of Resource Using Incompatible Type (Type Confusion)
Impact Analysis
CVE-2021-30869 carries a CVSS 3.1 score of 7.8 (HIGH), indicating a high-severity threat. The vulnerability is exploitable locally with low attack complexity, requires no authentication, though user interaction is needed. Successful exploitation can severely compromise data confidentiality, allow unauthorized modification of data and systems, and cause complete service disruption. Organizations running affected deployments face significant operational risk if this vulnerability remains unpatched.
Exploit Maturity
CVE-2021-30869 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 2.00% (83.5th percentile) indicates a notable probability of exploitation. While not currently associated with known ransomware campaigns, the confirmed exploitation status demands immediate attention. Federal agencies were required to remediate this vulnerability by 2021-11-17 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions.
- Verify that all instances of affected products (apple ipados (< 14.4), apple iphone os (>= 12.0, < 12.5.5; >= 14.0, < 14.4), apple mac os x (>= 10.14, <= 10.14.6; >= 10.15, <= 10.15.6; 10.14.6; 10.15.7), apple macos (>= 11.0, < 11.2)) have been updated to patched versions.
- If immediate patching is not possible, restrict local access on affected systems using access controls and least-privilege policies to limit exposure.
- Monitor systems for indicators of compromise, including unusual process activity, unexpected network connections, and unauthorized configuration changes.
- Review security logs and conduct threat hunting to determine if the vulnerability was exploited prior to patching.
Technical Details
CVE-2021-30869 affects Apple iOS, iPadOS, and macOS. A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 12.5.5, iOS 14.4 and iPadOS 14.4, macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, Security Update 2021-006 Catalina. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of reports that an exploit for this issue exists in the wild. The attack vector is local-based, meaning an attacker needs local access to the target system to exploit this vulnerability. The CVSS score of 7.8 reflects the combination of low exploitability and severe impact across confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2021-30869 being actively exploited?
Yes. CVE-2021-30869 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 2.00% (83.5th percentile) further indicates a notable exploitation probability.
What products are affected by CVE-2021-30869?
CVE-2021-30869 affects Apple iOS, iPadOS, and macOS. Specifically affected products include: apple ipados (< 14.4), apple iphone os (>= 12.0, < 12.5.5; >= 14.0, < 14.4), apple mac os x (>= 10.14, <= 10.14.6; >= 10.15, <= 10.15.6; 10.14.6; 10.15.7), apple macos (>= 11.0, < 11.2).
How do I fix CVE-2021-30869?
Apply updates per vendor instructions. Ensure all affected systems are updated to the latest patched versions. If patching is not immediately possible, implement host-level mitigations to limit exposure.
How severe is CVE-2021-30869?
CVE-2021-30869 has a CVSS 3.1 score of 7.8 (HIGH). This is a high-severity vulnerability that requires immediate attention and remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.