Sign-up

ID

VAR-202108-1149


CVE

CVE-2021-30995


TITLE

Race condition vulnerability in multiple Apple products

Trust: 0.8

sources: JVNDB: JVNDB-2021-021076

DESCRIPTION

A race condition was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, Security Update 2021-008 Catalina, iOS 15.2 and iPadOS 15.2, watchOS 8.3. A malicious application may be able to elevate privileges. iPadOS , iOS , Apple Mac OS X Race condition vulnerabilities exist in multiple Apple products.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows local attackers to escalate privileges on affected installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the handling of directory paths. An attacker can leverage this vulnerability to escalate privileges from low integrity and execute code in the context of root. Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. Apple watchOS is a smart watch operating system. Apple macOS Big Sur is a mobile application APP of Apple (Apple). Apple iPadOS is an operating system for iPad tablets. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2021-12-15-5 tvOS 15.2 tvOS 15.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT212980. Audio Available for: Apple TV 4K and Apple TV HD Impact: Parsing a maliciously crafted audio file may lead to disclosure of user information Description: A buffer overflow issue was addressed with improved memory handling. CVE-2021-30960: JunDong Xie of Ant Security Light-Year Lab CFNetwork Proxies Available for: Apple TV 4K and Apple TV HD Impact: User traffic might unexpectedly be leaked to a proxy server despite PAC configurations Description: A logic issue was addressed with improved state management. CVE-2021-30966: Michal Rajcan of Jamf, Matt Vlasach of Jamf (Wandera) ColorSync Available for: Apple TV 4K and Apple TV HD Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: A memory corruption issue in the processing of ICC profiles was addressed with improved input validation. CVE-2021-30926: Jeremy Brown CVE-2021-30942: Mateusz Jurczyk of Google Project Zero CoreAudio Available for: Apple TV 4K and Apple TV HD Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution Description: A buffer overflow issue was addressed with improved memory handling. CVE-2021-30957: JunDong Xie of Ant Security Light-Year Lab CoreAudio Available for: Apple TV 4K and Apple TV HD Impact: Playing a malicious audio file may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2021-30958: JunDong Xie of Ant Security Light-Year Lab Crash Reporter Available for: Apple TV 4K and Apple TV HD Impact: A local attacker may be able to elevate their privileges Description: This issue was addressed with improved checks. CVE-2021-30945: Zhipeng Huo (@R3dF09) and Yuebin Sun (@yuebinsun2020) of Tencent Security Xuanwu Lab (xlab.tencent.com) ImageIO Available for: Apple TV 4K and Apple TV HD Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2021-30939: Rui Yang and Xingwei Lin of Ant Security Light-Year Lab, Mickey Jin (@patch1t) of Trend Micro Kernel Available for: Apple TV 4K and Apple TV HD Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2021-30916: Zweig of Kunlun Lab Kernel Available for: Apple TV 4K and Apple TV HD Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A memory corruption vulnerability was addressed with improved locking. CVE-2021-30937: Sergei Glazunov of Google Project Zero Kernel Available for: Apple TV 4K and Apple TV HD Impact: An application may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed with improved memory management. CVE-2021-30927: Xinru Chi of Pangu Lab CVE-2021-30980: Xinru Chi of Pangu Lab Kernel Available for: Apple TV 4K and Apple TV HD Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2021-30949: Ian Beer of Google Project Zero Kernel Available for: Apple TV 4K and Apple TV HD Impact: An attacker in a privileged network position may be able to execute arbitrary code Description: A buffer overflow issue was addressed with improved memory handling. CVE-2021-30993: OSS-Fuzz, Ned Williamson of Google Project Zero Kernel Available for: Apple TV 4K and Apple TV HD Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved state handling. CVE-2021-30955: Zweig of Kunlun Lab Preferences Available for: Apple TV 4K and Apple TV HD Impact: A malicious application may be able to elevate privileges Description: A race condition was addressed with improved state handling. CVE-2021-30995: Mickey Jin (@patch1t) of Trend Micro, Mickey Jin (@patch1t) Sandbox Available for: Apple TV 4K and Apple TV HD Impact: A malicious application may be able to bypass certain Privacy preferences Description: A validation issue related to hard link behavior was addressed with improved sandbox restrictions. CVE-2021-30968: Csaba Fitzl (@theevilbit) of Offensive Security Sandbox Available for: Apple TV 4K and Apple TV HD Impact: An application may be able to access a user's files Description: An access issue was addressed with additional sandbox restrictions. CVE-2021-30947: Csaba Fitzl (@theevilbit) of Offensive Security WebKit Available for: Apple TV 4K and Apple TV HD Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A buffer overflow issue was addressed with improved memory handling. CVE-2021-30934: Dani Biro WebKit Available for: Apple TV 4K and Apple TV HD Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2021-30936: Chijin Zhou of ShuiMuYuLin Ltd and Tsinghua wingtecher lab CVE-2021-30951: Pangu WebKit Available for: Apple TV 4K and Apple TV HD Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: An integer overflow was addressed with improved input validation. CVE-2021-30952: WeBin WebKit Available for: Apple TV 4K and Apple TV HD Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A race condition was addressed with improved state handling. CVE-2021-30984: Kunlun Lab WebKit Available for: Apple TV 4K and Apple TV HD Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2021-30953: VRIJ WebKit Available for: Apple TV 4K and Apple TV HD Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A type confusion issue was addressed with improved memory handling. CVE-2021-30954: Kunlun Lab Additional recognition Bluetooth We would like to acknowledge Haram Park, Korea University for their assistance. ColorSync We would like to acknowledge Mateusz Jurczyk of Google Project Zero for their assistance. Contacts We would like to acknowledge Minchan Park (03stin) for their assistance. Kernel We would like to acknowledge Amit Klein of Bar-Ilan University's Center for Research in Applied Cryptography and Cyber Security for their assistance. WebKit We would like to acknowledge Jzhu, Peter Snyder of Brave, and Soroush Karami for their assistance. Installation note: Apple TV will periodically check for software updates. Alternatively, you may manually check for software updates by selecting "Settings -> System -> Software Update -> Update Software." To check the current version of software, select "Settings -> General -> About." Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEePiLW1MrMjw19XzoeC9qKD1prhgFAmG6UnYACgkQeC9qKD1p rhhvQw/+NiacWivmfnU4j3XbNMoxg7qvAKQtB8RTlz0h3vco6HoUBy1Y0X+dIvCr rCD6wuZZfnRF9DxpD3iPH2b1q0pEEJ1WVfYjG+3s3yuzZgskBkikcQ6vGFEHSQJL w+8tNQndjKIi45zlJJc2UO6lRmEWH5jGwqD3TCFJgruhBs1YM0Pp7vgqk0DTqmRf cE6DLKEbDCmeGklEmXxd4SHT45tLzTkbmHHE5cKnqJKMiM5Nv8Ds9ogwTxkOKBX1 vRxREGFwJrlF0/sX8TUhPWaqQnSles5RU0oiGT8Arag7njkhdaiOiZUYhtZRwAhl vAnfymJJ0JHWmuznMfgufIt65F46lZHc5FlpFGLAh9IblbqAxHwXsr4aIhFKNIWB 9O4QJnHfpdVutUFmF7sVvjYx6ePWzgdBBFpQO6MER61GA5cggHtwMXLRsmFCjIf+ nfaNSzQr6V2TeOk6//HpoRrhNjSs/dasedju/4G0hLK1L3YEitDRH4aERxjYysPp IduZRgaYfJWGOeIPAUeNtCHf88f7dS3dQUXLITDaQLOjRXbQgwegmYAPihkfCqS1 1tBXAXEPmBg0PIUnnBiZVhMPbFyQhJ9iC8rHrlmnLh6xnAb8pe8wo3xYH3115oS/ 31pvkkIamh7WZzbQ3+uzWOcGCI2zjtdA0+zHQxnBCveunoVum7c=TJJV -----END PGP SIGNATURE-----

Trust: 2.52

sources: NVD: CVE-2021-30995 // JVNDB: JVNDB-2021-021076 // ZDI: ZDI-22-360 // VULHUB: VHN-390728 // VULMON: CVE-2021-30995 // PACKETSTORM: 165358

AFFECTED PRODUCTS

vendor:applemodel:ipadosscope:ltversion:15.2

Trust: 1.0

vendor:applemodel:macosscope:ltversion:12.1

Trust: 1.0

vendor:applemodel:tvosscope:ltversion:15.2

Trust: 1.0

vendor:applemodel:macosscope:gteversion:12.0

Trust: 1.0

vendor:applemodel:mac os xscope:gteversion:10.15

Trust: 1.0

vendor:applemodel:iphone osscope:ltversion:15.2

Trust: 1.0

vendor:applemodel:macosscope:ltversion:11.6.2

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.15.7

Trust: 1.0

vendor:applemodel:macosscope:gteversion:11.0

Trust: 1.0

vendor:applemodel:mac os xscope:ltversion:10.15.7

Trust: 1.0

vendor:applemodel:watchosscope:ltversion:8.3

Trust: 1.0

vendor:アップルmodel:ipadosscope: - version: -

Trust: 0.8

vendor:アップルmodel:tvosscope: - version: -

Trust: 0.8

vendor:アップルmodel:watchosscope:eqversion:8.3

Trust: 0.8

vendor:アップルmodel:apple mac os xscope: - version: -

Trust: 0.8

vendor:アップルmodel:iosscope: - version: -

Trust: 0.8

vendor:アップルmodel:macosscope: - version: -

Trust: 0.8

vendor:applemodel:macosscope: - version: -

Trust: 0.7

sources: ZDI: ZDI-22-360 // JVNDB: JVNDB-2021-021076 // NVD: CVE-2021-30995

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-30995
value: HIGH

Trust: 1.0

NVD: CVE-2021-30995
value: HIGH

Trust: 0.8

ZDI: CVE-2021-30995
value: HIGH

Trust: 0.7

CNNVD: CNNVD-202108-2104
value: HIGH

Trust: 0.6

VULHUB: VHN-390728
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-30995
severity: MEDIUM
baseScore: 5.1
vectorString: AV:N/AC:H/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 4.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-390728
severity: MEDIUM
baseScore: 5.1
vectorString: AV:N/AC:H/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 4.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-30995
baseSeverity: HIGH
baseScore: 7.0
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.0
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2021-30995
baseSeverity: HIGH
baseScore: 7.0
vectorString: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2021-30995
baseSeverity: HIGH
baseScore: 7.8
vectorString: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-22-360 // VULHUB: VHN-390728 // JVNDB: JVNDB-2021-021076 // CNNVD: CNNVD-202108-2104 // NVD: CVE-2021-30995

PROBLEMTYPE DATA

problemtype:CWE-362

Trust: 1.1

problemtype:Race condition (CWE-362) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-390728 // JVNDB: JVNDB-2021-021076 // NVD: CVE-2021-30995

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202108-2104

TYPE

competition condition problem

Trust: 0.6

sources: CNNVD: CNNVD-202108-2104

PATCH

title:HT212980 Apple  Security updateurl:https://support.apple.com/en-us/HT212975

Trust: 0.8

title:Apple has issued an update to correct this vulnerability.url:https://support.apple.com/HT212979

Trust: 0.7

title:Apple iOS and iPadOS Repair measures for the competition condition problem loopholeurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=176806

Trust: 0.6

sources: ZDI: ZDI-22-360 // JVNDB: JVNDB-2021-021076 // CNNVD: CNNVD-202108-2104

EXTERNAL IDS

db:NVDid:CVE-2021-30995

Trust: 4.2

db:ZDIid:ZDI-22-360

Trust: 3.2

db:PACKETSTORMid:165358

Trust: 0.8

db:JVNDBid:JVNDB-2021-021076

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-15320

Trust: 0.7

db:AUSCERTid:ESB-2021.4260

Trust: 0.6

db:CS-HELPid:SB2021121434

Trust: 0.6

db:CNNVDid:CNNVD-202108-2104

Trust: 0.6

db:CNVDid:CNVD-2022-55135

Trust: 0.1

db:VULHUBid:VHN-390728

Trust: 0.1

db:VULMONid:CVE-2021-30995

Trust: 0.1

sources: ZDI: ZDI-22-360 // VULHUB: VHN-390728 // VULMON: CVE-2021-30995 // JVNDB: JVNDB-2021-021076 // PACKETSTORM: 165358 // CNNVD: CNNVD-202108-2104 // NVD: CVE-2021-30995

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-22-360/

Trust: 3.1

url:https://support.apple.com/en-us/ht212976

Trust: 2.3

url:https://support.apple.com/en-us/ht212975

Trust: 1.7

url:https://support.apple.com/en-us/ht212978

Trust: 1.7

url:https://support.apple.com/en-us/ht212979

Trust: 1.7

url:https://support.apple.com/en-us/ht212980

Trust: 1.7

url:https://support.apple.com/en-us/ht212981

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-30995

Trust: 0.9

url:https://support.apple.com/ht212979

Trust: 0.7

url:https://packetstormsecurity.com/files/165358/apple-security-advisory-2021-12-15-5.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.4260

Trust: 0.6

url:https://vigilance.fr/vulnerability/apple-macos-multiple-vulnerabilities-37064

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021121434

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30966

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30936

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30926

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30984

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30957

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30953

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30958

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30993

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30960

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30916

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30952

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30927

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30945

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30939

Trust: 0.1

url:https://www.apple.com/support/security/pgp/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30955

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30951

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30937

Trust: 0.1

url:https://support.apple.com/ht212980.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30954

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30934

Trust: 0.1

url:https://support.apple.com/kb/ht201222

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30968

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30980

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30949

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30947

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-30942

Trust: 0.1

sources: ZDI: ZDI-22-360 // VULHUB: VHN-390728 // VULMON: CVE-2021-30995 // JVNDB: JVNDB-2021-021076 // PACKETSTORM: 165358 // CNNVD: CNNVD-202108-2104 // NVD: CVE-2021-30995

CREDITS

Mickey Jin (@patch1t) of Trend Micro

Trust: 1.3

sources: ZDI: ZDI-22-360 // CNNVD: CNNVD-202108-2104

SOURCES

db:ZDIid:ZDI-22-360
db:VULHUBid:VHN-390728
db:VULMONid:CVE-2021-30995
db:JVNDBid:JVNDB-2021-021076
db:PACKETSTORMid:165358
db:CNNVDid:CNNVD-202108-2104
db:NVDid:CVE-2021-30995

LAST UPDATE DATE

2024-08-14T12:33:37.328000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-22-360date:2022-02-16T00:00:00
db:VULHUBid:VHN-390728date:2022-02-21T00:00:00
db:VULMONid:CVE-2021-30995date:2021-08-24T00:00:00
db:JVNDBid:JVNDB-2021-021076date:2024-07-17T06:55:00
db:CNNVDid:CNNVD-202108-2104date:2022-03-10T00:00:00
db:NVDid:CVE-2021-30995date:2023-11-07T03:34:15.133

SOURCES RELEASE DATE

db:ZDIid:ZDI-22-360date:2022-02-16T00:00:00
db:VULHUBid:VHN-390728date:2021-08-24T00:00:00
db:VULMONid:CVE-2021-30995date:2021-08-24T00:00:00
db:JVNDBid:JVNDB-2021-021076date:2024-07-17T00:00:00
db:PACKETSTORMid:165358date:2021-12-17T19:19:55
db:CNNVDid:CNNVD-202108-2104date:2021-08-24T00:00:00
db:NVDid:CVE-2021-30995date:2021-08-24T19:15:24.157