CVE-2020-9797: 
macOS vulnerability analysis and mitigation

CVE-2020-9797 is an information disclosure vulnerability discovered in Apple's operating systems that was fixed in iOS 13.5, iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, and watchOS 6.2.5, released in May 2020. The vulnerability allowed a malicious application to determine another application's memory layout (Apple iOS, Apple macOS).

The vulnerability was identified as an information disclosure issue in the kernel component of Apple's operating systems. The security flaw was addressed by removing the vulnerable code that allowed unauthorized memory layout access. The vulnerability has a CVSS v3.1 Base Score of 5.5 (Medium) with a vector string of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating local access is required with no privileges needed but user interaction is required (NVD).

When exploited, this vulnerability could allow a malicious application to determine the memory layout of other applications running on the system. This type of information disclosure could potentially be used as part of a larger attack chain to facilitate more serious exploits (Apple iOS).

The vulnerability requires local access and user interaction to be exploited. A malicious application would need to be installed on the target system to take advantage of this vulnerability (NVD).

Apple addressed this vulnerability by removing the vulnerable code in the following operating system updates: iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, and watchOS 6.2.5. Users should update their devices to these versions or later to protect against this vulnerability (Apple iOS, Apple macOS).