Vulnerability DatabaseCVE-2021-30860

CVE-2021-30860:
NixOS vulnerability analysis and mitigation

Overview

CVE-2021-30860 is a critical vulnerability discovered in Apple's CoreGraphics component that was actively exploited in the wild. The vulnerability, also known as FORCEDENTRY, was discovered by The Citizen Lab in March 2021 and disclosed to Apple in September 2021. The issue affects multiple Apple operating systems including iOS, iPadOS, macOS, and watchOS. The vulnerability is an integer overflow in Apple's image rendering library that could be exploited through maliciously crafted PDF files (Citizen Lab, Apple Support).

Technical details

The vulnerability is an integer overflow in Apple's CoreGraphics component that occurs during PDF processing. The issue was addressed with improved input validation. The vulnerability received a CVSS v3.1 base score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability specifically affects Apple's image rendering library and was discovered to be exploitable through maliciously crafted PDF files (NVD).

Impact

When exploited, this vulnerability allows processing of a maliciously crafted PDF to lead to arbitrary code execution with system privileges. The vulnerability was confirmed to be actively exploited in the wild as part of NSO Group's Pegasus spyware deployment against various targets. The exploit was effective against Apple iOS, MacOS and WatchOS devices (Citizen Lab).

Mitigation and workarounds

Apple addressed this vulnerability by releasing security updates across multiple platforms: iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, Security Update 2021-005 Catalina, and watchOS 7.6.2. For older devices, iOS 12.5.5 was also released to patch the vulnerability. Users are strongly advised to update their devices to these versions or later to protect against exploitation (Apple Support, Apple Support).

Community reactions

The discovery of this vulnerability highlighted the ongoing concerns about commercial spyware companies and their role in facilitating surveillance. The Citizen Lab noted that NSO Group's business model inherently leads to these discoveries, as their technology is often used recklessly by government clients in violation of international human rights law (Citizen Lab).