Loading vulnerability…
Apple Kernel Race Condition Privilege Escalation
CVE-2021-1782 is a privilege-escalation vulnerability in the kernels of macOS, iOS, iPadOS, watchOS, and tvOS. Improper locking leads to a race condition that a malicious application can exploit to elevate privileges, potentially executing arbitrary code with kernel privileges. The vulnerability is associated with kernel voucher handling, although the precise vulnerable function is not established here. Apple corrected the issue through improved locking. The vulnerability has been exploited in the wild and is included in CISA's Known Exploited Vulnerabilities catalog.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a malicious application to elevate privileges, potentially achieving arbitrary code execution with kernel privileges. This compromises the security boundary between application execution and the operating-system kernel.
If you can’t patch tonight, do this now.
Apply the vendor updates. Before patching, limit execution of untrusted applications, enforce application-control and device-management policies, and apply least privilege to reduce opportunities for local code execution. Monitoring for anomalous privilege changes may aid detection, but no complete workaround is identified.
Patch, then assume compromise.
Install the applicable security update or a later release containing the fix: macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4, iPadOS 14.4, watchOS 7.3, or tvOS 14.4. These updates correct the race condition through improved locking.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.