CVE-2021-30767: 
macOS vulnerability analysis and mitigation

A logic issue in Apple's TCC (Transparency, Consent, and Control) system was discovered and addressed in multiple Apple operating systems. The vulnerability (CVE-2021-30767) was fixed in macOS Big Sur 11.6.2, macOS Monterey 12.1, Security Update 2021-008 Catalina, iOS 15.2 and iPadOS 15.2, and watchOS 8.3, which were released on December 13, 2021 (Apple Security, Apple Monterey).

The vulnerability was identified as a logic issue in the TCC (Transparency, Consent, and Control) system component. The security flaw was addressed by implementing improved state management. The vulnerability received a CVSS 3.1 Base Score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) (NVD).

When exploited, this vulnerability could allow a local user to modify protected parts of the file system. This could potentially lead to unauthorized access to protected system areas and compromise system security (Apple Security).

The vulnerability requires local access to the system for exploitation. The attack complexity is considered low, requiring privileges but no user interaction to execute (NVD).

Apple addressed this vulnerability by releasing security updates across multiple operating systems. Users should update to macOS Big Sur 11.6.2, macOS Monterey 12.1, Security Update 2021-008 Catalina, iOS 15.2 and iPadOS 15.2, or watchOS 8.3 depending on their device (Apple Security, Apple Monterey).