CVE-2020-9809: 
macOS vulnerability analysis and mitigation

CVE-2020-9809 is an information disclosure vulnerability discovered in Apple's operating systems that was fixed in iOS 13.5, iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, and watchOS 6.2.5, released in May 2020. The vulnerability allowed a malicious application to determine kernel memory layout, which could potentially be used to compromise system security (Apple iOS, Apple macOS).

The vulnerability was identified as an information disclosure issue in the kernel component of Apple's operating systems. The security flaw was addressed by implementing improved state management to prevent unauthorized access to kernel memory layout information. The vulnerability has a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating local access is required but no privileges are needed (NVD).

If exploited, this vulnerability could allow a malicious application to determine the kernel memory layout. This information could potentially be used as part of a larger attack chain to develop more sophisticated exploits targeting the affected systems (Apple iOS).

The vulnerability requires local access and user interaction to be exploited. A malicious application would need to be installed on the target system to take advantage of this vulnerability (NVD).

Apple addressed this vulnerability by implementing improved state management in the following OS versions: iOS 13.5, iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, and watchOS 6.2.5. Users should update their devices to these versions or later to protect against this vulnerability (Apple iOS, Apple macOS).