medium5.5Known exploited
CVE-2020-27950
Apple Multiple Products Memory Initialization Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.
Apply updates per vendor instructions.
Impact
A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. A malicious application may be able to disclose kernel memory.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apple | Ipados | before 14.2 |
| Apple | Iphone Os | before 12.4.9 from 14.0 before 14.2 |
| Apple | Macos | before 10.15.7 from 11.0 before 11.0.1 |
| Apple | Watchos | before 5.3.9 from 6.0 before 6.2.9 from 7.0 before 7.1 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/161296/XNU-Kernel-Mach-Message-Trailers-Memory-Disclosure.html
- http://seclists.org/fulldisclosure/2020/Dec/32
- https://support.apple.com/en-us/HT211928
- https://support.apple.com/en-us/HT211929
- https://support.apple.com/en-us/HT211931
- https://support.apple.com/en-us/HT211940
- https://support.apple.com/en-us/HT211944
- https://support.apple.com/en-us/HT211945
- https://support.apple.com/en-us/HT211946
- https://support.apple.com/en-us/HT211947
- http://packetstormsecurity.com/files/161296/XNU-Kernel-Mach-Message-Trailers-Memory-Disclosure.html
- http://seclists.org/fulldisclosure/2020/Dec/32
- https://support.apple.com/en-us/HT211928
- https://support.apple.com/en-us/HT211929
- https://support.apple.com/en-us/HT211931
- https://support.apple.com/en-us/HT211940
- https://support.apple.com/en-us/HT211944
- https://support.apple.com/en-us/HT211945
- https://support.apple.com/en-us/HT211946
- https://support.apple.com/en-us/HT211947
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-27950