CVE-2021-30947: 
macOS vulnerability analysis and mitigation

CVE-2021-30947 is a sandbox access vulnerability discovered in Apple's operating systems. The issue was fixed in multiple Apple OS versions including macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, iOS 15.2 and iPadOS 15.2, watchOS 8.3, released in December 2021. The vulnerability was discovered by Csaba Fitzl (@theevilbit) of Offensive Security (Apple Support).

The vulnerability is an access control issue in Apple's sandbox implementation that could allow an application to access a user's files. The issue was addressed by implementing additional sandbox restrictions. The vulnerability has a CVSS v3.1 base score of 5.5 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (NVD).

If exploited, this vulnerability could allow a malicious application to bypass sandbox restrictions and gain unauthorized access to a user's files, potentially compromising user privacy and data confidentiality (Apple Support).

Apple has addressed this vulnerability by implementing additional sandbox restrictions in the following OS versions: macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, iOS 15.2 and iPadOS 15.2, and watchOS 8.3. Users are advised to update their devices to these versions or later to protect against this vulnerability (Apple Support).