CVE-2021-1782 vulnerability in Apple Products
Published on April 2, 2021

A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited..

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Known Exploited Vulnerability

This Apple iOS Privilege Escalation and Code Execution Chain vulnerability is part of CISA's list of Known Exploited Vulnerabilities. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited.

The following remediation steps are recommended / required by November 17, 2021: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2021-1782 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. It has an exploitability score of 1.0 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Improper Locking

The software does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Products Associated with CVE-2021-1782

You can be notified by stack.watch whenever vulnerabilities like CVE-2021-1782 are published in these products:

Apple iPadOS

Apple iOS

Apple macOS

Apple tvOS

Apple watchOS

What versions are vulnerable to CVE-2021-1782?