A vulnerability was found in Apple macOS up to 10.15.2 (Operating System). It has been declared as critical. Affected by this vulnerability is an unknown function of the component Kernel. The manipulation with an unknown input leads to a type confusion vulnerability. The CWE definition for the vulnerability is CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. A malicious application may be able to execute arbitrary code with system privileges.

The weakness was disclosed 01/28/2020 by Brandon Azad with Google Project Zero as HT210919 as confirmed advisory (Website). The advisory is shared at support.apple.com. This vulnerability is known as CVE-2020-3853. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The advisory points out:

A type confusion issue was addressed with improved memory handling.

Upgrading to version 10.15.3 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The entries VDB-150559, VDB-150560, VDB-150561 and VDB-150562 are pretty similar.

Productinfo

Type

• Operating System

Vendor

• Apple

Name

• macOS

Version

• 10.15.0
• 10.15.1
• 10.15.2

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion