Loading vulnerability…
Pointer Authentication Code bypass in Apple operating systems
CVE-2020-9870 is an Apple mitigation-bypass vulnerability described by Apple as a logic issue fixed through improved validation in iOS 13.6, iPadOS 13.6, macOS Catalina 10.15.6, and tvOS 13.4.8. According to the provided content, the issue allows an attacker who already has memory write capability to bypass pointer authentication codes (PAC/PACCage-related protections) and execute arbitrary code. The supporting context places this bug in a WebKit/JavaScriptCore exploit chain as one of the mitigation bypasses used alongside CVE-2020-9802, indicating it weakens a platform hardening mechanism rather than serving as the initial memory-corruption primitive itself. Specific vulnerable functions or code paths are not provided in the supplied material.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can defeat Apple pointer-authentication-based exploit mitigations, allowing an attacker with an existing memory write primitive to convert that capability into arbitrary code execution. In practical exploit chains, this materially increases exploit reliability and enables post-corruption execution on affected Apple platforms, including Safari/WebKit-driven chains discussed in the supplied context.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure to likely exploit delivery vectors such as untrusted web content in Safari/WebKit and limit attacker opportunities to obtain an initial memory write primitive. Standard compensating controls may reduce risk, but no complete mitigation is provided in the supplied content short of installing Apple's fixes.
Patch, then assume compromise.
Apply the vendor fixes: iOS 13.6, iPadOS 13.6, macOS Catalina 10.15.6, or tvOS 13.4.8, or later supported releases incorporating Apple's validation improvements. Because the issue is a mitigation bypass used in exploit chains, remediation should include patching both this CVE and any associated initial-access or memory-corruption vulnerabilities used with it.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.