CVE-2021-30900
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
Description
CVE-2021-30900 is a high-severity out-of-bounds write vulnerability affecting Apple iOS, iPadOS, and macOS. The flaw arises from insufficient bounds checking, allowing a malicious application to write data beyond the allocated memory buffer and execute arbitrary code with kernel privileges. This CVE-2021-30900 vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Apple addressed the out-of-bounds write issue in iOS 14.8.1, iPadOS 14.8.1, iOS 15.1, and iPadOS 15.1, making prompt patching essential for all affected devices.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | ipados | < 14.8.1; 15.0 |
| apple | iphone os | < 14.8.1; 15.0 |
| apple | macos | < 11.6.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://support.apple.com/en-us/HT212867(Vendor Advisory)
- https://support.apple.com/en-us/HT212868(Vendor Advisory)
- https://support.apple.com/kb/HT212872(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30900(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
The out-of-bounds write weakness in CVE-2021-30900 occurs when the affected Apple software writes data past the end or before the beginning of an intended buffer. In the context of iOS, iPadOS, and macOS, this memory corruption vulnerability allows a malicious application to overwrite adjacent memory regions, ultimately enabling arbitrary code execution at the kernel level.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2021-30900 carries a CVSS v3.1 score of 7.8 (High), reflecting significant security risk for Apple device users. Attack Vector (Local): The vulnerability requires the attacker to have local access, typically through a malicious application installed on the device. Attack Complexity (Low): Exploitation is straightforward with no special conditions required. Privileges Required (None): No authentication or elevated privileges are needed to trigger the vulnerability, though user interaction is required to install the malicious application. User Interaction (Required): A user must take an action, such as installing or running a malicious app, for the exploit to succeed. Confidentiality, Integrity, and Availability (all High): Successful exploitation grants kernel-level code execution, giving an attacker full control over the device, including access to sensitive data, the ability to modify system files, and potential to render the device unusable.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-30900 in the wild by adding it to the Known Exploited Vulnerabilities catalog, with a remediation deadline of April 20, 2023. No publicly available exploit code or proof-of-concept has been identified in the reference materials. The EPSS score of 1.19% places this vulnerability in the 78th percentile, indicating that while exploitation probability is relatively moderate compared to other vulnerabilities, the confirmed active exploitation makes immediate remediation critical.
Remediation
- Apply vendor patches immediately. As directed by CISA, apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Update Apple devices to iOS 14.8.1 or later, iPadOS 14.8.1 or later, or iOS 15.1 and iPadOS 15.1 as documented in Apple security advisories HT212867 and HT212868.
- Restrict application installation on managed devices by enforcing mobile device management (MDM) policies that limit which applications can be installed, reducing the risk of a malicious application triggering the out-of-bounds write vulnerability.
- Enable automatic updates on all Apple devices to ensure future security patches are applied promptly, and verify that devices running macOS are also updated to patched versions as referenced in Apple advisory HT212872.
- Monitor device logs for signs of anomalous kernel-level activity or unexpected application behavior that could indicate attempted exploitation of CVE-2021-30900.
- Implement endpoint detection and response (EDR) solutions on managed Apple devices to detect and block exploitation attempts targeting memory corruption vulnerabilities.
Technical Details
CVE-2021-30900 is a memory corruption vulnerability rooted in an out-of-bounds write condition (CWE-787) within Apple's iOS, iPadOS, and macOS operating systems. The flaw stems from insufficient bounds checking when processing certain data, allowing a write operation to exceed the boundaries of the allocated memory buffer. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that while the attack requires local access and user interaction (such as running a malicious app), the exploit itself is low-complexity and requires no privileges, resulting in complete compromise of confidentiality, integrity, and availability. The scope remains unchanged, meaning the impact is confined to the vulnerable component's security context, but since that context is the kernel, successful exploitation effectively grants full device control.
Frequently Asked Questions
Is CVE-2021-30900 being actively exploited?
Yes, CVE-2021-30900 has been confirmed as actively exploited in the wild. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of April 20, 2023. There is no known association with ransomware campaigns at this time.
What products are affected by CVE-2021-30900?
CVE-2021-30900 affects Apple iOS, iPadOS, and macOS. Specifically, the vulnerability is fixed in iOS 14.8.1 and iPadOS 14.8.1, as well as iOS 15.1 and iPadOS 15.1, meaning all earlier versions of these operating systems are potentially vulnerable.
How do I fix CVE-2021-30900?
Update affected Apple devices to iOS 14.8.1 or later, iPadOS 14.8.1 or later, or iOS 15.1 and iPadOS 15.1. Additionally, enforce MDM policies to restrict untrusted application installation and enable automatic updates to receive future security patches promptly.
How severe is CVE-2021-30900?
CVE-2021-30900 has a CVSS v3.1 score of 7.8, classified as High severity. The vulnerability sits in the 78th EPSS percentile, and its inclusion in CISA's KEV catalog confirms that it poses a real and immediate threat requiring urgent remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.