Apple Releases Urgent 0-Day Bug Patch for Mac, iPhone and iPad Devices

Apple on Monday rolled out an urgent security update for
iOS, iPadOS^[1], and macOS^[2] to address a zero-day
flaw that it said may have been actively exploited, making it the
thirteenth such vulnerability Apple has patched since the start of
this year.

The updates, which arrive less than a week after the company
released iOS 14.7, iPadOS 14.7, and macOS Big Sur 11.5 to the
public, fixes a memory corruption issue
(CVE-2021-30807) in the IOMobileFrameBuffer
component, a kernel extension for managing the screen framebuffer^[3], that could be abused to
execute arbitrary code with kernel privileges.

The company said it addressed the issue with improved memory
handling, noting it’s “aware of a report that this issue may have
been actively exploited.” As is typically the case, additional
details about the flaw have not been disclosed to prevent the
weaponization of the vulnerability for additional attacks. Apple
credited an anonymous researcher for discovering and reporting the
vulnerability.

The timing of the update also raises questions about whether the
zero-day had been exploited by NSO Group’s Pegasus software^[4], which has become the
focus of a series of investigative reports^[5]
that have exposed how the spyware tool turned mobile phones of
journalists, human rights activists, and others into portable
surveillance devices, granting complete access to sensitive
information stored in them.

CVE-2021-30807 is also the thirteenth zero-day vulnerability
addressed by Apple this year alone, including —

• CVE-2021-1782^[6]
  (Kernel) – A malicious application may be able to elevate
  privileges
• CVE-2021-1870^[7]
  (WebKit) – A remote attacker may be able to cause arbitrary code
  execution
• CVE-2021-1871^[8]
  (WebKit) – A remote attacker may be able to cause arbitrary code
  execution
• CVE-2021-1879^[9]
  (WebKit) – Processing maliciously crafted web content may lead to
  universal cross-site scripting
• CVE-2021-30657^[10] (System Preferences) –
  A malicious application may bypass Gatekeeper checks
• CVE-2021-30661^[11] (WebKit Storage) –
  Processing maliciously crafted web content may lead to arbitrary
  code execution
• CVE-2021-30663^[12] (WebKit) – Processing
  maliciously crafted web content may lead to arbitrary code
  execution
• CVE-2021-30665^[13] (WebKit) – Processing
  maliciously crafted web content may lead to arbitrary code
  execution
• CVE-2021-30666^[14] (WebKit) – Processing
  maliciously crafted web content may lead to arbitrary code
  execution
• CVE-2021-30713^[15] (TCC framework) – A
  malicious application may be able to bypass Privacy
  preferences
• CVE-2021-30761^[16] (WebKit) – Processing
  maliciously crafted web content may lead to arbitrary code
  execution
• CVE-2021-30762^[17] (WebKit) – Processing
  maliciously crafted web content may lead to arbitrary code
  execution

Given the public availability^[18] of a proof-of-concept
(PoC) exploit, it’s highly recommended that users move quickly to
update their devices to the latest version to mitigate the risk
associated with the flaw.