CVE-2020-27932
CVE-2020-27932
In short
A type confusion vulnerability in Apple systems allows a malicious app to execute code with the highest system privileges (kernel level). This is a serious flaw because it lets attackers take complete control of your device.
Technical detail
CWE-843 type confusion vulnerability in Apple's state handling allows a local, malicious application to bypass type checking and execute arbitrary code in kernel context. The vulnerability requires a malicious app already installed on the system; exploitation leads to privilege escalation and complete system compromise.
Summary generated and translated by AI from the official description.
A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. A malicious application may be able to execute arbitrary code with kernel privileges.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
public PoCs found — 1
cve_referencepacketstormsecurity.com/files/161295/XNU-Kernel-Turnstiles-Type-Confusion.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://packetstormsecurity.com/files/161295/XNU-Kernel-Turnstiles-Type-Confusion.htmlhttp://seclists.org/fulldisclosure/2020/Dec/32https://support.apple.com/en-us/HT211928https://support.apple.com/en-us/HT211929https://support.apple.com/en-us/HT211931https://support.apple.com/en-us/HT211940https://support.apple.com/en-us/HT211944https://support.apple.com/en-us/HT211945https://support.apple.com/en-us/HT211946https://support.apple.com/en-us/HT211947https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-27932