CVE-2021-30807

2021-04-13T00:00:00
ID AKB:13D7A136-347D-489A-908C-898F80E4B285
Type attackerkb
Reporter AttackerKB
Modified 2021-04-13T00:00:00

Description

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Recent assessments:

gwillcox-r7 at July 27, 2021 1:48pm UTC reported:

Vulnerability is a WebContent->EL1 local privilege elevation vulnerability in Apple iOS and iPadOS prior to 14.7.1 that exploits a vulnerability in the IOMobileFramebufferLegacy::get_displayed_surface() function whereby an attacker can control a 32 bit value that is being used to index into an array in order to cause an out of bound read. This can then be used to read the port name of an IOSurface object. Once this information is obtained, the attacker can then use known read/write primitives within the IOSurface object to gain the arbitrary kernel read/write they need to elevate their privileges. More details can be found at <https://saaramar.github.io/IOMobileFrameBuffer_LPE_POC/> along with a working PoC.

It should be noticed that Apple has supposedly stated this was exploited in the wild according to <https://support.apple.com/en-us/HT212623> however from what I’ve heard Apple has stated jailbreak exploits were “exploited in the wild” and there are rumors that this was perhaps just used by people in private to jailbreak their phones, so I’d take Apple’s word with a slight grain of salt. That being said the impact should be considered the same regardless given the relative ease of exploitation of this vulnerability combined with the fact that a working PoC has now been published.

AmirFedida at July 27, 2021 11:57am UTC reported:

Vulnerability is a WebContent->EL1 local privilege elevation vulnerability in Apple iOS and iPadOS prior to 14.7.1 that exploits a vulnerability in the IOMobileFramebufferLegacy::get_displayed_surface() function whereby an attacker can control a 32 bit value that is being used to index into an array in order to cause an out of bound read. This can then be used to read the port name of an IOSurface object. Once this information is obtained, the attacker can then use known read/write primitives within the IOSurface object to gain the arbitrary kernel read/write they need to elevate their privileges. More details can be found at <https://saaramar.github.io/IOMobileFrameBuffer_LPE_POC/> along with a working PoC.

It should be noticed that Apple has supposedly stated this was exploited in the wild according to <https://support.apple.com/en-us/HT212623> however from what I’ve heard Apple has stated jailbreak exploits were “exploited in the wild” and there are rumors that this was perhaps just used by people in private to jailbreak their phones, so I’d take Apple’s word with a slight grain of salt. That being said the impact should be considered the same regardless given the relative ease of exploitation of this vulnerability combined with the fact that a working PoC has now been published.

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 4