CVEs / CVE-2021-31010
CVE-2021-31010: Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability
- Known exploited in the CISA KEV catalog since 25 Aug 2022
- high 7.5 CVSS 3.1 (NVD)
- EPSS 3.67% chance of exploitation in the next 30 days, higher than 89% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2021-31010
Summary
In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions.
Description
A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Apple macOS | from unspecified, before 11.6 | 11.6 |
| Apple macOS | from unspecified, before 2021 | 2021 |
| Apple watchOS | from unspecified, before 7.6 | 7.6 |
| Apple watchOS | from unspecified, before 14.8 | 14.8 |
| Apple watchOS | from unspecified, before 12.5 | 12.5 |
Exploitation
| In CISA KEV since | 25 Aug 2022 |
|---|---|
| Due date for US federal agencies | 15 Sep 2022 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply updates per vendor instructions. |
Severity
| CVSS 3.1 | 7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NScored by NVD |
|---|---|
| Weakness | CWE-502 |
References
- CVE-2021-31010 on NVD
- CVE-2021-31010 in the CISA KEV catalog
- https://support.apple.com/en-us/HT212804 (cited by CISA)
- https://support.apple.com/en-us/HT212805 (cited by CISA)
- https://support.apple.com/en-us/HT212806 (cited by CISA)
- https://support.apple.com/en-us/HT212807 (cited by CISA)
- https://support.apple.com/en-us/HT212824 (cited by CISA)
- https://support.apple.com/en-us/HT212804 Vendor Advisory
- https://support.apple.com/en-us/HT212805 Vendor Advisory
- https://support.apple.com/en-us/HT212806 Vendor Advisory
- https://support.apple.com/en-us/HT212807 Vendor Advisory
- https://support.apple.com/en-us/HT212824 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31010 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.