CVE-2021-30858

HIGH KEV

iOS <14.8-iPadOS <14.8-macOS Big Sur <11.6 - Use After Free

Title source: llm

Description

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Exploits (2)

nomisec STUB 1 stars

by kmeps4 · infoleak

https://github.com/kmeps4/CVEREV3

View Code ZIP pw:eip

nomisec STUB

by Jeromeyoung · infoleak

https://github.com/Jeromeyoung/ps4_8.00_vuln_poc

View Code ZIP pw:eip

References (19)

[Mailing List, Third Party Advisory] http://seclists.org/fulldisclosure/2021/Sep/25

[Mailing List, Third Party Advisory] http://seclists.org/fulldisclosure/2021/Sep/27

[Mailing List, Third Party Advisory] http://seclists.org/fulldisclosure/2021/Sep/29

[Mailing List, Third Party Advisory] http://seclists.org/fulldisclosure/2021/Sep/38

[Mailing List, Third Party Advisory] http://seclists.org/fulldisclosure/2021/Sep/39

[Mailing List, Third Party Advisory] http://seclists.org/fulldisclosure/2021/Sep/50

[Mailing List] http://www.openwall.com/lists/oss-security/2021/09/20/1

[Mailing List] http://www.openwall.com/lists/oss-security/2021/10/26/9

[Mailing List] http://www.openwall.com/lists/oss-security/2021/10/27/1

[Mailing List] http://www.openwall.com/lists/oss-security/2021/10/27/2

[Mailing List] http://www.openwall.com/lists/oss-security/2021/10/27/4

[Release Notes] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BO6DMTHZR57JDBOXPSNR2MKDMCRWV265/

[Release Notes] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XYNV7ASK4LQVAUMJXNXBS3Z7RVDQ2N3W/

[Third Party Advisory] https://support.apple.com/en-us/HT212804

[Third Party Advisory] https://support.apple.com/en-us/HT212807

[Third Party Advisory] https://support.apple.com/kb/HT212824

[Mailing List, Third Party Advisory] https://www.debian.org/security/2021/dsa-4975

[Mailing List, Third Party Advisory] https://www.debian.org/security/2021/dsa-4976

[US Government Resource] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30858

Scores

CVSS v3 8.8

EPSS 0.0079

EPSS Percentile 74.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CISA KEV 2021-11-03

VulnCheck KEV 2021-09-13

InTheWild.io 2021-09-13

ENISA EUVD EUVD-2021-17775

CWE

CWE-416

Status published

Products (7)

apple/ipados 13.1 - 14.8

apple/iphone_os < 12.5.5

apple/macos < 11.6

debian/debian_linux 10.0

debian/debian_linux 11.0

fedoraproject/fedora 33

fedoraproject/fedora 34

Published Aug 24, 2021

KEV Added Nov 03, 2021

Tracked Since Feb 18, 2026