Apple Patches Two macOS smbfs Kernel Memory Disclosure Flaws

Apple patched two kernel memory disclosure vulnerabilities in the macOS smbfs driver, tracked as CVE-2021-30844 and CVE-2021-30845, affecting macOS Big Sur 11.0 through 11.2.3. Both flaws could expose adjacent kernel heap data during SMB operations, creating conditions that could aid further exploitation. STAR Labs reported that Apple was notified in June and released fixes alongside security updates for affected systems.

CVE-2021-30844 stems from the SMBIOC_T2RQ ioctl path, where attacker-controlled data copied into t2p->t_name may not be NULL-terminated before later string handling, causing an out-of-bounds read and leaking kernel memory to an SMB server. CVE-2021-30845 affects smbfs_mount, where insufficient validation of unique_id_len against the fixed-size unique_id buffer in smb_mount_args can also trigger an out-of-bounds read during a mount request. Proof-of-concept demonstrations used fake or controlled SMB servers to show unintended kernel data disclosure, and the recommended mitigation is to update macOS to the latest available version.