CVE-2021-1782highunder attackCWE-667

CVE-2021-1782: high-severity vulnerability in Apple macOS

Published · Updated

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

73Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7epss 2.2%
from disclosure to weaponsame day
Published on NVDApr 2
1st PoCFeb 4
CISA KEV+215d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

A timing flaw in macOS and iOS allows a malicious app to gain elevated privileges by exploiting a race condition in the system's locking mechanism. This is dangerous because the app could bypass security restrictions and access sensitive system functions.

Technical detail

A race condition in a kernel or system service's locking implementation allows a local attacker to execute privileged operations out of intended order. The vulnerability requires running a malicious application on the target device; exploitation leads to privilege escalation and potential system compromise. Apple reported active exploitation in the wild.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited..
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.