PT-2021-5396 · Apple · Watchos+2

Linus Henze · Published 2021-07-19 · Updated 2021-09-15 · CVE-2021-30770

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions iOS versions prior to 14.7 tvOS versions prior to 14.7 watchOS versions prior to 7.6

Description A logic issue was addressed with improved validation, which could allow an attacker that has already achieved kernel code execution to bypass kernel memory mitigations. The vulnerability is related to insufficient authentication mechanism in the kernel of the operating systems, which may enable a perpetrator to elevate their privileges.

Recommendations For iOS versions prior to 14.7, update to iOS 14.7 or later. For tvOS versions prior to 14.7, update to tvOS 14.7 or later. For watchOS versions prior to 7.6, update to watchOS 7.6 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-254

Related Identifiers

BDU:2021-06235

CVE-2021-30770

Affected Products

Ios

Tvos

Watchos

References · 7

• https://support.apple.com/en-us/HT212605 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-30770 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-30770 · Security Note
• https://support.apple.com/en-us/HT212601 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-06235 · Security Note
• https://support.apple.com/en-us/HT212604 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2021072218 · Note