CVE-2021-30807 is a high-severity vulnerability that affects various Apple systems, including macOS, iOS, iPadOS, and watchOS. This memory corruption issue, found in IOMobileFrameBuffer, allows an application to execute arbitrary code with kernel privileges. Apple has addressed the problem with improved memory handling in recent updates, and it's important to note that the company is aware of reports that this vulnerability may have been actively exploited. To protect your devices, ensure they are updated to the latest software versions.

How do I know if I'm affected?

If you're wondering whether your device is affected by this vulnerability, you'll need to check your device's operating system version. Devices running macOS Big Sur up to (excluding) version 11.5.1, iOS up to (excluding) version 14.7.1, iPadOS up to (excluding) version 14.7.1, and watchOS up to (excluding) version 7.6.1 may be affected. This vulnerability allows an application to execute arbitrary code with kernel privileges, and there have been reports of it being actively exploited. To determine if you're affected, simply verify your device's software version and compare it to the versions mentioned above.

What should I do if I'm affected?

If you're affected, it's crucial to update your device to the latest software version. For macOS, update to Big Sur 11.5.1 or later. For iOS and iPadOS, update to 14.7.1 or later. For watchOS, update to 7.6.1 or later. Updating your device will address the memory corruption issue and help protect against potential exploits.

Is CVE-2021-30807 in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, it is in CISA's Known Exploited Vulnerabilities Catalog. The vulnerability, named Apple Multiple Products Memory Corruption Vulnerability, was added on November 3, 2021, with a due date of November 17, 2021. This high-severity memory corruption issue has been addressed by Apple in various software updates, including macOS Big Sur 11.5.1, iOS 14.7.1, iPadOS 14.7.1, and watchOS 7.6.1.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-787, also known as an out-of-bounds write, which involves a memory corruption issue in Apple devices. Updating to the latest software versions helps address this weakness and protect your device.

For more details

CVE-2021-30807 is a high-severity vulnerability affecting various Apple systems, which has been addressed in recent software updates. Users are encouraged to update their devices to protect against potential exploits. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the links below.

• NVD - CVE-2021-30807

• Security content of macOS Big Sur 11.5.1 - Apple Support

• Security content of iOS 14.7.1 and iPadOS 14.7.1 - Apple Support

• Security content of watchOS 7.6.1 - Apple Support