CVE-2021-30900

What it actually does

CVE-2021-30900 is an out-of-bounds write vulnerability in Apple operating systems that can allow a malicious local application to corrupt kernel memory and execute arbitrary code with kernel privileges. Because kernel privileges sit below normal application sandboxing and user-level controls, successful exploitation can enable privilege escalation, sandbox escape, security control bypass, and full compromise of the affected device. The CVSS vector indicates local attack access, low attack complexity, no privileges required, and user interaction required, with high confidentiality, integrity, and availability impact.

Why it matters to the business

Successful exploitation can give an attacker deep control over an affected iPhone, iPad, or Mac, potentially exposing sensitive data, enabling persistence, bypassing security protections, and disrupting device availability. This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog and has been observed as actively exploited in the wild, so organizations with unmanaged, unpatched, or legacy Apple devices should treat remediation as urgent even though exploitation generally requires a malicious app or user-driven execution path. The CISA remediation due date was 2023-04-20, meaning federal agencies and many risk programs consider this overdue if still present.

How an attack unfolds

An attacker typically needs to get malicious code onto the target Apple device, most often by persuading a user to install or run a malicious application, by chaining this flaw with another delivery or code-execution vulnerability, or by abusing an enterprise, sideloading, or developer-profile workflow where available. Once the malicious application runs, it triggers the vulnerable kernel code path and performs an out-of-bounds write, corrupting memory in a controlled way. The exploit then redirects execution or manipulates kernel structures to gain kernel-level code execution. With kernel privileges, the attacker can bypass normal application sandbox restrictions, access protected data, interfere with security monitoring, install additional payloads, or use the device as a foothold for further activity. Because this vulnerability is KEV-listed and categorized as active in the wild, security teams should assume exploit chains may have used it alongside other Apple platform vulnerabilities rather than as a standalone intrusion technique.

How to fix it

Upgrade affected Apple devices to a fixed or later operating system version. Apple fixed this issue in iOS 14.8.1 and iPadOS 14.8.1, and in iOS 15.1 and iPadOS 15.1; devices should preferably be upgraded to the latest supported iOS, iPadOS, or macOS release rather than only the minimum fixed version. For devices that cannot be upgraded, reduce exposure by removing untrusted or unnecessary apps, disabling sideloading or unmanaged developer profiles where applicable, enforcing mobile device management compliance policies, restricting installation from unknown sources, and isolating or retiring unsupported devices. Review Apple security updates for corresponding macOS fixes applicable to managed Mac fleets and ensure all supported Apple platforms are fully patched.

How to confirm the fix worked

Confirm device operating system versions through MDM inventory, endpoint management, or direct device settings and verify they are at or above the fixed versions: iOS/iPadOS 14.8.1, iOS/iPadOS 15.1, or a later supported release. For macOS, verify the device has received the Apple security update that includes the fix or is running a later supported macOS build. Validate that compliance policies flag older Apple OS versions as noncompliant and that unmanaged or jailbroken devices are blocked from sensitive access. Where possible, perform sample checks on representative devices to confirm patch installation, app inventory integrity, absence of unauthorized profiles, and that security telemetry is still functioning after remediation.

Typical attack path

1. Identify a target using a vulnerable version of iOS, iPadOS, or macOS.
2. Deliver or stage a malicious application or exploit chain that can execute code locally on the device.
3. Convince the user to interact with the malicious content, install the app, open a crafted item, or otherwise trigger the local execution path.
4. Invoke the vulnerable kernel code path and perform an out-of-bounds write against kernel memory.
5. Use memory corruption to obtain arbitrary code execution with kernel privileges.
6. Bypass sandboxing or platform security controls and access protected data or system functions.
7. Deploy follow-on capabilities such as surveillance tooling, credential theft, persistence mechanisms, or additional payloads.

How to detect it

Retrospective detection is difficult because successful kernel-level exploitation may leave few stable artifacts and public reporting for this issue does not provide a universal exploit string. Focus on endpoint, MDM, unified logging, app inventory, and crash telemetry from devices that were running vulnerable versions. Review MDM records for devices below iOS/iPadOS 14.8.1 or 15.1 and corresponding macOS security update levels during periods of exposure. Look for installation or execution of unknown apps, unexpected enterprise-signed apps, untrusted configuration profiles, developer profiles, recent trust changes, jailbreak indicators, repeated kernel panics, unusual crash logs around the time a suspicious app was used, disabled security agents, and unexplained changes to privacy permissions. On macOS, review Unified Logs, Endpoint Security/EDR telemetry, process execution, system extension changes, launch agents/daemons, privileged helper tools, and kernel panic logs for suspicious activity. For iOS/iPadOS, rely on MDM inventory, device analytics logs, sysdiagnose captures where available, mobile threat defense alerts, app/provisioning-profile inventories, and evidence of unauthorized profiles or sideloading. If a device was vulnerable and shows suspicious app/profile activity or kernel crash patterns, treat it as potentially compromised and perform device reimaging or replacement according to incident response policy.

• iOS 14.8 or earlier
• iPadOS 14.8 or earlier
• iOS 15.0
• iPadOS 15.0
• panic-full
• panic-base
• ResetCounter
• JetsamEvent
• com.apple.WebKit
• embedded.mobileprovision
• /Library/LaunchAgents/
• /Library/LaunchDaemons/
• /Library/PrivilegedHelperTools/
• /Library/Extensions/
• /System/Library/Extensions/
• /var/db/ConfigurationProfiles/
• /private/var/db/ConfigurationProfiles/
• /private/var/containers/Bundle/Application/
• /private/var/mobile/Library/Logs/CrashReporter/
• /Library/Logs/DiagnosticReports/
• kernel panic
• EXC_BAD_ACCESS
• KERN_INVALID_ADDRESS
• out-of-bounds

What your security team should do

• Immediately identify all iOS, iPadOS, and macOS devices running versions older than the fixed releases or otherwise missing Apple security updates for this issue.
• Prioritize patching or retirement of exposed, high-risk, executive, privileged-user, developer, and unmanaged Apple devices because the vulnerability is KEV-listed and actively exploited in the wild.
• Enforce MDM compliance rules requiring fixed or later OS versions before allowing access to enterprise resources.
• Review installed applications, enterprise certificates, configuration profiles, developer profiles, and sideloading permissions for unauthorized or suspicious entries.
• Investigate devices that were vulnerable during the active exploitation window for signs of malicious apps, jailbreak artifacts, suspicious profiles, crashes, or unusual security service behavior.
• Restrict installation of apps from untrusted sources and remove unnecessary enterprise distribution mechanisms where not required.
• Monitor Apple security advisories and threat intelligence for exploit-chain details, since kernel vulnerabilities on Apple platforms are commonly combined with browser, messaging, or app-level initial access bugs.