HIGH

CVE-2021-1782

Apple Ipados 2021-04-02 CVSS v3.1

CVSS

KEV

Description

A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited..

Summary dbcve.org

This is a race condition vulnerability in Apple's kernel/secure kernel that allows a malicious local application to elevate privileges to root or kernel level. The vulnerability was addressed with improved locking mechanisms. Apple publicly acknowledged this was being actively exploited in the wild as a zero-day.

Mitigation

Apply the appropriate Apple security update for the affected OS version (iOS 14.4, iPadOS 14.4, macOS 11.2/2021-001, watchOS 7.3, tvOS 14.4) to all managed devices. In enterprise environments, verify complete deployment across all endpoints.

Weakness (CWE)

CWE-667 Improper Locking

EPSS Score

2.22%

Probability of exploitation in next 30 days

81.9th percentile

References

https://support.apple.com/en-us/HT212146 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT212147 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT212148 Release Notes, Vendor Advisory https://support.apple.com/en-us/HT212149 Release Notes, Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1782 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE