Table of Contents
October 12, 2021
|3m
How To Fix CVE-2021-30883, A Memory Corruption Issue In iOS 15.0.1 And Below?
Apple rolled out a security update with the release of 15.0.2 on 11th Oct. In the security update, Apple fixed a memory corruption issue in iOS v15.0.1 and below versions tracking as CVE-2021-30883. Let’s see how you can fix CVE-2021-30883. With fixing this zero-day vulnerability, it made Apple fix 17 zero-days since the start of the year.
What Is CVE-2021-30883?
According to the security researchers, this is the 2nd zero-day vulnerability found in the “IOMobileFrameBuffer” component. To be clear, this is a memory corruption issue in the “IOMobileFrameBuffer” that could allow adversaries to execute arbitrary code (ACE) with kernel privileges on the victim’s device. The report also says that the zero-day has been seen actively exploiting in the wild.The iPhone maker didn’t release technical details about the CVE-2021-30883 vulnerability. If you are keen to know more about the vulnerability, Security researcher Saar Amar published a post with some technical specifics and Proof of Concept (POC).
What Is The Impact Of CVE-2021-30883?
POC says that “This attack surface is highly interesting because it’s accessible from the app sandbox (so it’s great for jailbreaks) and many other processes, making it a good candidate for LPEs exploits in chains (WebContent, etc.).” Attackers can abuse the vulnerability to execute arbitrary code with kernel privileges just by installing an application on the victim’s device.
Devices Affected With CVE-2021-30883:
This vulnerability affects all iPhones, iPads, and iPods running iOS v15.0.1 and below.
How To Fix CVE-2021-30883?
Apple fixed the CVE-2021-30883 vulnerability with improved memory handling in iOS 15.0.2 and iPadOS 15.0.2 and asked its users to update the iOS to the newest version (iOS 15.0.2 and iPadOS 15.0.2). You can visit the Apple Product Security page for more information about the security. With this, we recommend few best practices to follow to stay away from such zero-days.
Run device memory cleanup over time using a trusted premium application.
Keep your device up-to-date with regular on-time updates.
Don’t keep unused apps.
Install apps only from the App store.
We hope this post would help you in fixing CVE-2021-30883 with some simple best practices. Thanks for reading this threat post. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this.
You may also like these articles:
Arun KL
Arun KL is a cybersecurity professional with 15+ years of experience in IT infrastructure, cloud security, vulnerability management, Penetration Testing, security operations, and incident response. He is adept at designing and implementing robust security solutions to safeguard systems and data. Arun holds multiple industry certifications including CCNA, CCNA Security, RHCE, CEH, and AWS Security.
